Russian Hackers Infiltrate Hotel WiFi Networks with AI-Powered Malware

Microsoft has issued a warning to Windows PC users about Russian hackers infiltrating their devices on hotel WiFi networks. The tech company attributed the attacks to Storm-2945, a sub-cluster of Russia's Midnight Blizzard.

The campaign, known as CaptiveCrunch, targets corporate travelers with credential theft and malware delivered through compromised guest networks. Microsoft discovered the threat in May and has been aware of it since then.

The hackers use AI to support their attacks, displaying fake verification checks, sign-in prompts, and software updates on legitimate WiFi gateways. They also disguise malware as Windows updates and deliver it directly to users' devices.

Micosoft has identified a remote-access trojan (RAT) called CornFlake that allows hackers to record keystrokes, collect files, steal credentials and session tokens, and capture screenshots. The RAT can also hijack a device's audio and video capabilities for surveillance.