Russian Hackers Targeting Hotel Wi-Fi Networks: What Travelers Need to Know

Introduction

Russian state-sponsored hackers are targeting hotel Wi-Fi networks worldwide. Microsoft has issued a warning about a new cyberattack operation called CaptiveCrunch, which is putting travelers at serious risk.

The attacks are being carried out by a hacker group known as Storm-2945, which is linked to Russia's Foreign Intelligence Service (SVR). This is the same group behind the famous Midnight Blizzard (also called APT29 or Cozy Bear) attacks.

What Is CaptiveCrunch?

CaptiveCrunch is the name Microsoft gave to this internet hijacking operation. It involves hackers compromising Wi-Fi networks at hotels, conferences, airports, and other public venues.

Microsoft first observed these attacks in May 2026. The hackers are specifically targeting "hospitality-related organizations" and their guest Wi-Fi networks.

What makes this attack dangerous is that it uses captive portals — the login screens you see when connecting to hotel Wi-Fi — to trick users into downloading malware.

How Does the Hotel Wi-Fi Hack Work?

Here is how the CaptiveCrunch attack works step by step:

• Step 1: You connect to the hotel Wi-Fi network.
• Step 2: A fake captive portal (login screen) appears.
• Step 3: You are prompted to download an "update" or "security patch."
• Step 4: The download installs malware on your device.
• Step 5: The malware steals your passwords, browser cookies, and documents.
• Step 6: Hackers can now access your emails, OneDrive, and more.

In some cases, users are redirected to fake login screens that look like Google or Microsoft pages. When you enter your credentials, the hackers steal them.

Fake Pop-Ups You Might See

Microsoft has identified several fake pop-ups that hackers use to trick you. Here are the most common ones:

• winupdate: A fake Windows Update screen saying "Working on updates… Don't turn off your computer"
• defender: A fake Windows Security virus scan
• directx: A "DirectX End-User Runtime Web Installer"
• vcredist: A Microsoft Visual C++ installer
• sysopt: A disk optimization utility
• netfix: A false Windows Network Diagnostics tool
• browser: A fake browser update prompt
• pdfview: A document viewer installer

You may also see Google-looking screens that say "Verify it's you" or "Our systems have detected unusual traffic from your computer network." These are all fake.

What Do the Hackers Want?

The hackers are after sensitive information, including:

• Browser cookies — to hijack your online sessions
• Passwords — for email, banking, and work accounts
• Documents — including sensitive work files
• Microsoft 365 credentials — to access your email and OneDrive
• Keystrokes — everything you type on your device
• Screenshots and audio — to spy on your activities

Once they have access to your Microsoft 365 account, they can read your emails, access your files, and even send emails from your account.

How to Protect Yourself

Microsoft recommends these steps to stay safe:

• Use your phone hotspot instead of hotel Wi-Fi. Private connections are much safer than public networks.
• Never download software updates from pop-ups. Legitimate updates come through your device settings, not from web pages.
• Look carefully at login screens. If it looks suspicious, don't enter your credentials.
• Use a VPN. A Virtual Private Network encrypts your internet traffic and makes it harder for hackers to intercept.
• Enable Multi-Factor Authentication (MFA). Even if hackers steal your password, MFA adds an extra layer of protection.
• Keep your device updated. Install security updates regularly to patch known vulnerabilities.
• Be skeptical of urgent requests. Hackers create a sense of urgency to make you act without thinking.

What Businesses Can Do

If you manage a business or have employees who travel, here are some additional steps:

• Educate employees about the risks of public Wi-Fi and how to spot fake pop-ups.
• Provide company VPNs for all traveling employees.
• Review what information employees share when connecting to guest networks.
• Consider using zero-trust security to limit access even if credentials are stolen.

Final Thoughts

The CaptiveCrunch attacks show that even hotel Wi-Fi is not safe. Russian state-sponsored hackers are actively targeting travelers and hospitality venues worldwide.

The good news is that you can protect yourself. By using your phone hotspot, avoiding suspicious pop-ups, and using a VPN, you can stay safe while traveling.

Remember: If you see a pop-up asking you to download or update something while on hotel Wi-Fi, do not click it. It is almost certainly a trap.

If you need help securing your business devices or want to learn more about protecting your data, contact SystemLogicIT for a free security assessment.