{"id":723831,"date":"2026-08-02T04:03:16","date_gmt":"2026-08-02T04:03:16","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/723831\/"},"modified":"2026-08-02T04:03:16","modified_gmt":"2026-08-02T04:03:16","slug":"microsoft-issues-hotel-wi-fi-warning-for-windows-pc-users","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/723831\/","title":{"rendered":"Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users"},"content":{"rendered":"

\"Microsoft<\/p>\n

New Microsoft warnings for travelers.<\/p>\n

Getty Images<\/p>\n

\u201cOrganizations should assume that public and hospitality network infrastructure might not be trustworthy,\u201d Microsoft<\/a> warned Friday, marking a notable hardening of its security advice for business travelers. A new hacking threat attributed to Russian threat actors \u201ctargets travelers worldwide for malware delivery and credential theft.”<\/p>\n

The warning follows the discovery of CaptiveCrunch, a global campaign attributed by Microsoft to Storm-2945, a sub-cluster of Russia\u2019s Midnight Blizzard. The campaign targets corporate travelers with credential theft and malware delivered through compromised guest networks.<\/p>\n

ForbesWho Owns Trust\u2014Zero Trust Is About To Fail Its AI TestBy Zak Doffman<\/a><\/p>\n

Microsoft says the activity has been under way since early May, involving hospitality networks and other guest networks served by captive portals worldwide.<\/p>\n

Its warning follows a July report from ReliaQuest<\/a>, which found attackers targeting Microsoft 365 users through compromised Wi-Fi gateways. By manipulating network traffic, the attackers redirect guests to fake sign-in pages without first sending a phishing email or compromising the PC.<\/p>\n

In a timely twist given recent concerns about the use of AI in cyberattacks, Microsoft Threat Intelligence thanked Anthropic and OpenAI for their \u201ccollaboration and support during this investigation.\u201d Microsoft says Storm-2945 used AI to support the threat campaign.<\/p>\n

\u201cIn addition to variants of malware targeting Windows systems,\u201d Microsoft says it is \u201calso aware of indications that the threat actor might be targeting Android devices with similar techniques as the ClickFix landings also include instructions for Android devices to download and install an APK file.\u201d<\/p>\n

The attackers compromise hospitality infrastructure to display fake verification checks, sign-in prompts and software updates. Because these pages appear while users are connecting through a hotel or venue\u2019s legitimate Wi-Fi gateway, the deception is difficult for users to recognize.<\/p>\n

Some victims are directed to Microsoft\u2019s legitimate device-code authentication process. The attacker initiates a sign-in attempt and persuades the victim to enter an attacker-supplied code. If the victim approves the request, Microsoft issues valid authentication tokens to enable access to the victim\u2019s account without needing to steal a password or directly bypass multi-factor authentication.<\/p>\n

While ReliaQuest\u2019s research centered on credential theft, Microsoft reports that the attacks can deliver malware directly to victims\u2019 devices, significantly broadening the threat. The campaign can also deliver malware disguised as Windows updates.<\/p>\n

Forbes\u2018Blue Bubbles\u2019\u2014Apple Says iPhone Messaging Is Still \u2018Best\u2019By Zak Doffman<\/a><\/p>\n

Microsoft has named the Windows remote-access trojan CornFlake. The RAT is designed to steal credentials and session tokens, record keystrokes, collect files and capture screenshots. It can also hijack a device\u2019s audio and video capabilities for surveillance, and give attackers persistent access.<\/p>\n

Microsoft advises travelers to treat hotel, conference, airport and other guest networks as untrusted. It recommends using mobile hotspots, cellular connections or other private connectivity, avoiding updates through captive portals, strengthening Conditional Access and phishing-resistant authentication and also blocking device-code authentication when not required.<\/p>\n","protected":false},"excerpt":{"rendered":"New Microsoft warnings for travelers. Getty Images \u201cOrganizations should assume that public and hospitality network infrastructure might not…\n","protected":false},"author":2,"featured_media":723832,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[239198,59,696,239199,86,56,54,55,4315,239197,239200,2767],"class_list":["post-723831","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-cornflake","tag-gb","tag-microsoft","tag-microsoft-warnings-microsoft-hacker","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom","tag-wi-fi","tag-widespread-compromise","tag-windows-hacker","tag-windows-warning"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/723831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=723831"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/723831\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/723832"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=723831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=723831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=723831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}