Midnight Blizzard targets travelers via hotel Wi-Fi captive portals

Microsoft Threat Intelligence has issued a warning regarding CaptiveCrunch, a cyberattack campaign linked to the Midnight Blizzard sub-cluster, Storm-2945. The operation targets travelers by manipulating hotel Wi-Fi captive portals—the sign-in pages used to access guest networks.

Attackers redirect users through controlled infrastructure by manipulating DNS and HTTP traffic. Once redirected, victims are presented with convincing, fake prompts for browser or operating system updates. These prompts use ClickFix techniques to trick users into installing malicious payloads, including Windows remote-access trojans written in Go and a Rust variant of CornFlake.

The campaign aims to steal credentials, cloud session tokens, and files. Beyond direct malware installation, the attackers utilize device-code phishing to persuade victims to approve unauthorized authentication sessions. The threat affects both Windows and Android devices and may involve compromises of shared captive-portal services rather than isolated hotel venues.