The initiative, named ‘CaptiveCrunch’, has been operational since at least May, as per Microsoft’s findings. It focuses on Wi-Fi networks in hotels, conference centers, and other locations that offer public guest access.
“To date, Microsoft has detected extensive breaches of Wi-Fi networks at hospitality-related entities and other networks utilizing captive portal equipment across multiple countries,” the company stated in its report.
Microsoft noted that these attacks are associated with Storm-2945, a hacking group reportedly linked to the Russian cybercrime organization Midnight Blizzard, also referred to as APT29 or Cozy Bear.
How does the hotel Wi-Fi attack operate?
The attack initiates when a traveler attempts to connect to a hotel’s Wi-Fi. Typically, guests are redirected to a login page, known as a captive portal, where they enter their credentials to access the internet. Hackers can infiltrate these systems and alter the content displayed to users.
Rather than seeing a standard Wi-Fi login page, travelers might encounter fraudulent messages urging them to update their browser, install a security tool, or resolve a network issue. These alerts can mimic legitimate Windows or Google notifications. For instance, “Our systems have detected unusual traffic from your computer network. Please complete the security check to access Google Search.”
If an individual downloads the file or adheres to the provided instructions, malware can be introduced to their device.
Microsoft indicated that various types of fake pop-ups might manifest when someone connects to a compromised Wi-Fi network.
These can resemble:
A Windows update screen
A counterfeit Windows Security virus scan
A DirectX installer
A Microsoft Visual C++ installer
A bogus disk optimization tool
A Windows network troubleshooting tool
A browser update alert
A document viewer installer
Hackers can capture audio and video
Microsoft stated that attackers can record audio and video, capture screenshots, monitor keystrokes, and steal browser cookies and saved passwords. They can also exploit stolen credentials to infiltrate accounts. Some victims might be redirected to fake login pages aimed at harvesting their Microsoft 365 credentials.
How to safeguard against these attacks
Microsoft has urged travelers to exercise caution when using hotel and public Wi-Fi.
The company advises utilizing a personal mobile hotspot instead of public Wi-Fi whenever feasible. Travelers should also refrain from downloading software, browser updates, or security tools presented through hotel Wi-Fi login pages or unexpected pop-ups.
Users should also be vigilant when entering passwords on pages that suddenly appear after connecting to a public network.
