Using free hotel WiFi? Your data could be at risk, Microsoft warns

Free hotel Wi-Fi may seem like a convenient way to get online while travelling, but Microsoft is warning you to be cautious. Microsoft Threat Intelligence has identified a cyberattack campaign targeting hotel and other guest Wi-Fi networks, with attackers using compromised networks to install malware and steal sensitive information.

The campaign, dubbed CaptiveCrunch, has been observed since early May 2026 and has been linked by Microsoft to Storm-2945, a subgroup of Midnight Blizzard, the Russia-linked hacking group also known as APT29 or Cozy Bear. Microsoft says the campaign targets hotel and other guest Wi-Fi networks worldwide, with the attackers appearing to have a particular interest in business travellers and their corporate accounts.

Must read: AI assistant hacks gym booking system in first known Australian autonomous cyberattack

How hackers are targeting hotel Wi-Fi

The attack exploits captive portals, the login or verification pages users typically encounter when connecting to hotel Wi-Fi. Microsoft says Storm-2945 has been observed manipulating DNS and HTTP traffic from networks served by these portals to redirect users to malicious websites.

You may then encounter fake Windows, browser, or security prompts asking you to install a software update, complete a verification process, or fix a network issue. Some pages are designed to look like legitimate Windows Update or Google verification screens. Android users may also be instructed to download and install an APK file.

Microsoft has also identified device-code phishing in the campaign, which can trick users into authenticating an attacker-controlled session and potentially give attackers access to corporate accounts.

Must read: Data breach costs for Indian firms hit record ₹25.5 crore as AI-driven cyber threats surge 

Malware can steal files and monitor devices

Microsoft identified malware, including CornFlake and ChocoShell, in the campaign. CornFlake, a Windows remote-access trojan, can steal files and credentials, collect keystrokes and session tokens, capture screenshots and conduct audio and video surveillance.

ChocoShell is primarily designed to steal browser session cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials.

Microsoft recommends treating hotel, airport, conference and other public Wi-Fi networks as untrusted. Travellers should use a mobile hotspot, eSIM or another private connection where possible.

The company also advises you not to download software, certificates or security tools through Wi-Fi login pages. Updates should instead be installed through the official operating system or app update mechanisms.