Hotel Wi-Fi Is Stealing Corporate Logins: Inside the CaptiveCrunch DNS Hijacking Campaign

You check into a hotel, join the Wi-Fi, type in your room number — and log in to Microsoft 365 to check work email. Nothing looks wrong. But the network itself has been turned against you. Since early 2026, attackers have been breaking into hotel and conference Wi-Fi systems and quietly redirecting guests to fake login pages. Microsoft says the campaign comes from a Russian state-linked group. It has a name now: CaptiveCrunch.

The target is not your laptop — it is the gateway

The attackers do not hack guests one by one. They break into the Wi-Fi gateway device itself — the hardware that runs the captive portal, the page that asks for your room number and last name before you get online. The way in is embarrassingly ordinary: internet-facing management interfaces with weak or default passwords.

Once they have administrative control, they change the gateway's DNS settings. DNS is the internet's address book: your device asks it where a domain lives, and the gateway answers with the attacker's IP address instead. The interception happens upstream of whatever you configured on your own device — switching to a public resolver like 8.8.8.8 does not help, because the gateway itself decides where your traffic goes before your preference is ever consulted.

So the guest types the real Microsoft address and lands on a fake login page built to look identical. Nothing is wrong with the laptop. No phishing email was ever sent. Traditional email security never sees the attack, because it happens at the network level, not in the inbox.

The fake login page

The pages impersonate Microsoft 365, built on lookalike domains the attackers registered — m365-owa[.]com and owa-ms365[.]com among them. ReliaQuest's Threat Spotlight, published July 23, 2026, documented the campaign: underway since at least June 2026, with compromised gateways across multiple US cities as well as India and Saudi Arabia, and victims spanning finance, law, healthcare, energy, retail and professional services.

That is why this attack works so well. The victim did everything right — they typed the real address, they were on a network they had every reason to trust, and the page in front of them looked correct. The failure was not theirs. It was the hotel's.

The cleverer trick: device-code phishing

The second attack vector does not even need a fake page. It abuses Microsoft's device-code authentication flow — a legitimate feature built for signing in on devices with no keyboard, like a smart TV or a conference-room console.

The victim is sent to Microsoft's real login page and asked to enter a short code. Everything about it looks correct, because it is the real page. What the victim does not know is that the code they are entering approves a login session the attacker started, not one of their own. Enter it, and Microsoft hands the attacker a valid access token for the account — without the attacker ever needing a password, and without any of it looking like the credential theft your training taught you to watch for.

Microsoft observed abuse of the device-code flow starting in July 2026. From July 16, some CaptiveCrunch landing pages began redirecting victims to phishing pages exploiting this flow. A third vector rounds out the campaign: fake software-update prompts using the ClickFix technique, pushed to guests who click and run them.

Who is behind it

Microsoft attributes CaptiveCrunch to Storm-2945, an operational sub-group of Midnight Blizzard — the group also known as APT29, which the US and UK governments link to Russia's foreign intelligence service. Microsoft disclosed the attribution on July 31, 2026. The activity has been documented since at least February 2026, with a sharp escalation in early May, when attackers began modifying DNS settings on captive-portal gateways to create adversary-in-the-middle positions.

ReliaQuest documented the same infrastructure eight days before Microsoft's disclosure. Its analysts noted the tradecraft echoes FrostArmada, a DNS hijacking campaign linked to APT28 — also known as Fancy Bear — which targeted vulnerable small-office and home-office routers. Microsoft and the UK's National Cyber Security Centre disclosed FrostArmada in April 2026; the NCSC identified TP-Link's WR841N as one exploited model, likely compromised through CVE-2023-50224.

The malware on the other side of CaptiveCrunch is CornFlake, a Go-based remote access trojan with keylogging, screen, audio and webcam capture and multi-layered persistence, plus a second family called ChocoShell. Anthropic's September 2026 threat intelligence report documented the operation as well, and Thailand's cyber security agency, ThaiCERT, warned travellers about it on August 3, 2026.

How to protect yourself on hotel Wi-Fi

1. Use your phone's hotspot instead. For anything involving a login, cellular data is the safest option — it never passes through the hotel gateway at all.
2. If you must use hotel Wi-Fi, use a VPN. It encrypts the traffic between your device and the VPN server. An attacker who controls the DNS can still redirect your connection, but they cannot read what is inside it.
3. Never enter a device code you did not start yourself. If a page asks for a code and you did not just request one on another device, close it. That prompt is the attack.
4. Check the URL before you type a password. Especially on a captive portal. Lookalike domains are the whole trick — one wrong letter is all it takes.
5. Never install an update that pops up after joining Wi-Fi. Real browser and operating system updates do not arrive through a hotel login page.
6. Keep MFA on — and for IT teams, watch the device-code flow. Consider blocking device-code authentication where it is not needed, and alert on logins from places your people are not supposed to be.

Where things stand

CaptiveCrunch is a reminder that the network you trust least is the one you notice least. A hotel Wi-Fi login feels routine — that is exactly why it works as an attack surface. The fix is not to stop travelling. It is to treat every shared network as hostile by default: hotspot first, VPN second, and never approve a login you did not start.