Russian Hackers Use Phony Sign-In Pages to Steal Hotel Wi-Fi Credentials

Microsoft has issued a security warning regarding a new cyber threat targeting hotel Wi-Fi networks. The operation, named 'CativeCrunch,' involves hackers using phony sign-in pages to steal login credentials and infect devices with malware. This campaign, linked to the Russian espionage group Storm-2945, has been active since May and affects hospitality networks worldwide.

The hackers tamper with Wi-Fi equipment at hotels and conference centers, redirecting users to fake Microsoft 365 login pages. This poses a significant risk to business travelers, as the compromised network can appear normal, making the attack difficult to detect. The cybersecurity firm ReliaQuest reported compromised Wi-Fi gateways in several U.S. cities.

Microsoft's warning highlights the use of AI by Storm-2945 to support the campaign. The hackers manipulate network traffic to display fake verification checks and software updates, tricking users into downloading malware. The malware, named CornFlake and ChocoShell, can steal credentials, record keystrokes, and capture audio and video.

To protect against this threat, Microsoft advises travelers to treat public Wi-Fi networks as untrusted. Using a mobile hotspot, avoiding updates through captive portals, and employing phishing-resistant authentication are recommended. Additionally, disabling device-code authentication when not needed can help prevent unauthorized access.