Russian hackers target hotel Wi-Fi networks to steal Microsoft 365 accounts

Russian hackers have been hijacking hotel Wi-Fi networks to steal Microsoft 365 accounts. This operation, attributed to the group Midnight Blizzard, has been active since early May 2026. The attackers utilize captive portals to deploy malware, compromising user accounts through infostealers.

Microsoft has issued a warning regarding this ongoing threat, advising travelers to exercise caution when connecting to hotel Wi-Fi. The campaign underscores the risks associated with public internet access and the need for increased vigilance among users.

The operation, named CaptiveCrunch, is linked to the Russian threat actor Midnight Blizzard, also known as APT29. Since May 2026, these attacks have demonstrated the persistence and sophistication of cybercriminals targeting vulnerable networks. The exploitation of captive portals to deploy malware raises concerns about the security of public Wi-Fi, particularly in the hospitality sector.

As the attacks continue, the implications for both travelers and businesses are significant. Increased awareness of these vulnerabilities may lead to stronger cybersecurity measures across the hospitality industry, as stakeholders recognize the need to protect sensitive user information.

Looking ahead, travelers should consider using VPNs when connecting to hotel Wi-Fi networks to enhance their security. The hospitality sector may see a rise in cybersecurity measures as a direct response to these attacks. Additionally, there is potential for similar attacks targeting other public Wi-Fi networks, prompting a broader discussion on cybersecurity practices.

As cyber threats evolve, it is crucial for both individuals and businesses to remain vigilant and adopt stronger security practices to safeguard sensitive information from malicious actors.