Wi‑Fi DNS hijacks targeting Microsoft 365 – Aug 2026

Claims

What the coverage asserts, and how many sources carry each claim.

• [● 17 SOURCES] The CaptiveCrunch campaign has been active since early May 2026.
• [● 17 SOURCES] Storm‑2945, a sub‑cluster of Midnight Blizzard, is behind the CaptiveCrunch campaign.
• [● 17 SOURCES] Attackers compromise hospitality Wi‑Fi captive portals and manipulate DNS and HTTP traffic to redirect users.
• [● 17 SOURCES] Victims are redirected to counterfeit Microsoft 365 sign‑in pages that harvest credentials.
• [● 17 SOURCES] Attackers use ClickFix‑style fake update prompts to deliver malware.
• [● 17 SOURCES] The malware families CornFlake and ChocoShell are deployed on compromised devices.
• [● 17 SOURCES] The malware can record keystrokes, capture audio/video, and steal session tokens to bypass MFA.
• [● 17 SOURCES] Microsoft advises travelers to use personal mobile hotspots, VPNs, and avoid installing unexpected pop‑up updates on captive portals.
• [● 15 SOURCES] The CaptiveCrunch campaign targets travelers by compromising hotel Wi‑Fi captive portals.
• [● 15 SOURCES] The campaign is attributed to Storm‑2945, a sub‑cluster of the Russian state‑sponsored group Midnight Blizzard (APT29/Cozy Bear).
• [● 13 SOURCES] Microsoft recommends using personal hotspots, VPNs, and phishing‑resistant MFA to mitigate the threat.

Timeline

1. 22 days ago

   [TECHNOLOGY] 4 sources

   Microsoft warns of Russian hacking campaign targeting hotel Wi-Fi

   Microsoft warns of a Russian hacking campaign targeting hotel and conference center Wi-Fi networks to steal Microsoft 365 credentials and bypass two-factor authentication.

2. about 1 month ago

   [TECHNOLOGY] 3 sources

   Storm-2945 hackers target hotel Wi-Fi in global espionage campaign

   Russian hackers from Storm-2945 are targeting hotel and airport Wi-Fi via the ‘CaptiveCrunch’ campaign, using DNS hijacking to steal credentials from Windows and Android users.

3. about 1 month ago

   [TECHNOLOGY] 21 sources

   Midnight Blizzard exploits hotel Wi‑Fi captive portals to steal Microsoft 365 credentials

   Midnight Blizzard’s Storm‑2945 group runs the CaptiveCrunch campaign, hijacking hotel Wi‑Fi captive portals since May 2026 to deliver CornFlake/ChocoShell malware via fake Microsoft 365 logins and ClickFix fake

4. about 1 month ago

   [TECHNOLOGY] 16 sources

   Midnight Blizzard's CaptiveCrunch hijacks hotel Wi‑Fi to steal Microsoft 365 credentials

   Midnight Blizzard’s Storm‑2945 sub‑cluster runs the CaptiveCrunch campaign, hijacking hotel Wi‑Fi to phish Microsoft 365 credentials and deploy CornFlake and ChocoShell malware; Microsoft advises VPNs, personal

5. about 2 months ago

   [TECHNOLOGY] 6 sources

   Microsoft authentication systems targeted in multi‑stage cyber attacks

   Cyber attackers are abusing legitimate remote‑access tools, hijacking hotel Wi‑Fi DNS to steal Microsoft 365 credentials, and exploiting Microsoft’s own login flow in phishing campaigns that hit dozens of firms

6. about 2 months ago

   [TECHNOLOGY] 3 sources

   APT28-linked Wi‑Fi hijacks steal Microsoft 365 credentials, MedusaHVNC RAT uncovered

   APT28-linked Wi‑Fi hijacks steal Microsoft 365 credentials worldwide, while the new MedusaHVNC RAT uses hidden desktops to evade detection.

7. about 2 months ago

   [TECHNOLOGY] 4 sources

   Microsoft-365 Accounts Compromised by Hotel Wi‑Fi DNS Attacks and AI Cloud Security Gaps

   Check Point reports 78% of firms faced AI‑related breaches in 2025, with a large enforcement gap. Meanwhile, hackers hijack hotel Wi‑Fi gateways to redirect Microsoft‑365 logins, bypassing MFA via a DNS and Dev

Sources

agora-web.jp · b2b-cyber-security.de · bergischeuhren.de · blog.clavis.com.br · blogspan.net · borncity.com · c3pb.de · capital.fr · chip.cz · connect.ro · countryrebel.com · cumbernauld-media.com · cyberinsider.com · cybersecuritynews.com · dagens.no · descopera.ro · flagthis.com · focus.de · gamesite.sk · gulfnews.com · hothardware.com · ilsoftware.it · iltalehti.fi · infoguerra.com.br · it-boltwise.de · ithome.com · itnerd.blog · itvoice.in · kosmo.at · lifehacker.com.au · m.macitynet.it · m.winfuture.de · michael-bickel.de · musikknyheter.no · ntd.com · nytimespost.com · planet.fr · que.com · sea.mashable.com · securityaffairs.co · securityaffairs.com · solidsoftwaretools.com · tecnologia.libero.it · teknoblog.com · thehackernews.com · trend.dk · upday.com · vegandisneyfood.com