Russian hackers hijack hotel Wi-Fi captive portals

A Russian state-sponsored hacking group has been hijacking hotel and conference WiFi networks worldwide since early May to steal corporate travelers' credentials and install espionage malware, according to new research from Microsoft. The campaign, which Microsoft has named CaptiveCrunch, targets the captive portal pages users must access before connecting to the internet at hotels, conference centers, and other shared venues.

Microsoft attributes the activity to Storm2945, a subcluster of the hacking group Midnight Blizzard, also known as APT29 or Cozy Bear. The U.S. and U.K. governments have previously linked Midnight Blizzard to Russia's Foreign Intelligence Service (SVR). The attackers compromise the networks to manipulate DNS and HTTP traffic, redirecting guests to attacker-controlled infrastructure.

Instead of waiting for users to visit a website, the hackers intercept the automated connectivity checks performed by browsers and operating systems when joining a new network. These checks return pages that impersonate fake browser or operating system updates. The pages use "ClickFix" social engineering techniques, presenting fake verification failures with instructions to...