Microsoft warns of Russian Wi-Fi hijacking campaign

Microsoft has identified a cyberattack campaign dubbed ‘CaptiveCrunch,’ attributed to the Russian state-sponsored hacking group Storm-2945. The group, a sub-cluster of Midnight Blizzard, is actively hijacking Wi-Fi networks at hotels, venues, and airports to target travelers.

Unlike traditional phishing, this operation compromises the Wi-Fi captive portals—the login pages guests encounter before accessing the internet. Once the infrastructure is compromised, attackers can redirect guest traffic to fake update prompts or phishing pages. These malicious redirects are designed to steal Microsoft 365 credentials and browser data, or in some instances, grant attackers full control over the victim's device.

Microsoft researchers note that Storm-2945 is linked to Russia’s Foreign Intelligence Service and has a history of targeting government and corporate networks in the United States and Europe. Security experts advise businesses to treat all public Wi-Fi as untrusted and recommend using company VPNs or personal hotspots to mitigate these risks.