Russian hackers are using hotel Wi-Fi networks around the world to infect travelersʼ devices with malware and steal their sensitive data by creating fake login pages and fake software updates.
Microsoft warned about this, writes Cybernews.
According to Microsoft, Russian hackers have stepped up espionage cyberattacks against Western organizations. However, instead of directly attacking corporate networks, they are more likely to target company employees traveling on business.
The hacking group Midnight Blizzard is behind this. It typically attacks government agencies, diplomatic missions, non-governmental organizations, and IT service providers. Microsoft calls their attack campaign CaptiveCrunch, and it has been active since at least May. The hackers infect login pages that travelers use to connect to hotel Wi-Fi.
Storm-2945 (a subset of Midnight Blizzard) then steals Microsoft 365 credentials and distributes malware via fake login pages and fake app update requests. However, this spyware network can also attack any organization that uses Wi-Fi networks with authorization portals, including airports, universities, and healthcare facilities.
- Midnight Blizzard is a Russian hacking group linked to the Russian Foreign Intelligence Service. They specialize in cyber espionage, diplomatic and government attacks.
For more news and in-depth stories from Ukraine, please follow us on X.