Microsoft has attributed the recent hotel Wi‑Fi hijacking campaign to Storm-2945, a Russian state-sponsored subgroup within Midnight Blizzard, turning what first appeared to be a broad credential-phishing problem into a more serious espionage and endpoint-compromise risk for traveling workers. The attackers are compromising captive-portal gateways, altering DNS responses, and redirecting guests toward Microsoft-themed credential lures or malware pages before users ever receive a conventional phishing email.
The attribution, described by Microsoft and reported by Risky Business, materially revises the initial picture published by ReliaQuest on July 23. ReliaQuest had documented compromised hotel and conference-center gateways in U.S. cities, India, and Saudi Arabia and found tradecraft resembling FrostArmada, an operation linked to Russia’s GRU-associated APT28, also known as Forest Blizzard or Fancy Bear. ReliaQuest explicitly stopped short of directly attributing its campaign to APT28.
Microsoft now says the hotel Wi‑Fi activity belongs instead to Storm-2945, which it tracks as part of Midnight Blizzard—the Russian SVR-linked cluster also called APT29 or Cozy Bear. Microsoft also says the operation began in May 2026, reaches organizations beyond hotels and conference venues, and includes malware delivery alongside account theft.
That is more than an intelligence-label correction. It changes the likely stakes for Windows and Microsoft 365 environments: a compromised guest network can become a delivery point for surveillance malware, Entra token theft, and access to corporate mailboxes, not merely a nuisance phishing redirect.
The attack does not require exploitation of a traveler’s laptop at the outset. Once an intruder has administrative control of a hotel’s Wi‑Fi gateway or captive-portal appliance, it controls DNS resolution and, in some cases, proxy-related traffic for every device joining that network.
ReliaQuest’s investigation found that the attackers could direct legitimate-looking Microsoft 365 sign-in attempts to attacker-controlled web infrastructure. A guest does not need to click a malicious email attachment or follow a suspicious Teams message. Connecting to the network and then attempting to reach corporate mail can be sufficient to put the victim in front of an impersonation page.
This is a particularly awkward attack model for enterprises because the device may appear healthy. Endpoint protection can see the final connection or suspicious downloaded file, but the initial trigger occurs at the network layer—outside the employee’s normal browsing habits and outside the organization’s own DNS infrastructure.
ReliaQuest also observed attempted abuse of Web Proxy Auto-Discovery, or WPAD, in roughly one-third of the cases it examined. WPAD is still relevant to Windows fleets because it can instruct clients to retrieve proxy configuration automatically. On a hostile network, an unexpected WPAD response can broaden the attacker’s ability to direct web traffic, while leaving activity that resembles ordinary HTTPS traffic in local logs.
The practical implication is that IT teams should stop thinking of hotel Wi‑Fi solely as an untrusted internet connection. In this campaign, the network gateway is being used as an active intermediary between the endpoint and Microsoft services.
ReliaQuest’s original reporting said the hotel and conference-center campaign shared techniques with FrostArmada: compromised network devices, altered DNS settings, Microsoft-focused lures, and adversary-in-the-middle account compromise. But it assessed only a low-to-medium-confidence connection to APT28 and stated that it lacked direct technical links such as reused infrastructure, malware, or an operational security failure tying the operators together.
Microsoft’s assessment identifies Storm-2945 within Midnight Blizzard instead and says this campaign is not connected to FrostArmada. Those conclusions can coexist: attackers from separate Russian services can reuse an effective technique, especially one that turns a single poorly protected gateway into access to dozens or hundreds of transient corporate targets.
The distinction matters operationally because APT28 and APT29 are commonly associated with different Russian intelligence services and historically distinct collection priorities. APT28 is generally linked to the GRU, Russia’s military intelligence service; Midnight Blizzard is widely tied to the SVR, Russia’s foreign intelligence service. Microsoft’s Storm-2945 attribution therefore points to a campaign that should be treated as potential state collection activity rather than as a generic criminal credential-theft scheme.
Neither Microsoft nor ReliaQuest has publicly named the compromised hotel brands, gateway vendors, number of affected networks, or the initial vulnerability used to take over the appliances. ReliaQuest said exposed management interfaces and weak or reused administrative credentials were a plausible entry path, but emphasized that it could not confirm that hypothesis because it lacked visibility into the individual gateways.
That missing information leaves hotel operators with an uncomfortable problem. There is no announced patch list to apply, no named appliance family to search for, and no public estimate of how many properties have been remediated. Operators need to assume that internet-exposed management services, reused administrator passwords, and unmonitored DNS configuration changes are the relevant exposure until the vendors or investigators provide more detail.
ClickFix is a social-engineering pattern that presents the victim with a fake error, verification step, browser update, or access instruction, then tells them to copy and run a command. The attacker does not need a remote-code-execution flaw in Windows if the user can be convinced to execute the payload locally.
According to Microsoft, the final payloads include CornFlake RAT and CocoShell, a PowerShell-based information stealer, communicating with a previously unseen command-and-control panel called FruitStone. The public reporting does not yet include hashes, file paths, domains, network indicators, persistence mechanisms, or a complete capability breakdown for either payload. That absence means defenders cannot responsibly treat a filename-based antivirus search as a sufficient hunt.
For Windows administrators, the better immediate controls are behavioral:
Microsoft Entra device-code flow exists for devices that cannot conveniently display a browser or accept rich text input. An application begins a sign-in flow and shows a code; the user completes authentication elsewhere; the application receives a valid token. In an abuse scenario, the attacker starts the flow, persuades the victim to enter or approve the code, and receives the resulting access token.
ReliaQuest observed device-code-flow abuse on attacker infrastructure associated with the hotel Wi‑Fi campaign. The important consequence is that users can complete real Microsoft authentication and MFA prompts while authorizing an attacker-controlled session. A user who has been trained only to reject unexpected password pages may still fall for this, because the actual sign-in page can be legitimate.
Microsoft’s Entra guidance already classifies device-code flow as high risk and recommends blocking it wherever possible through Conditional Access. That recommendation should now move from a future hardening task to an immediate audit item for organizations with frequent travelers.
Before blocking device-code flow tenant-wide, administrators should identify valid dependencies. Teams Rooms, Android-based Teams devices, shared meeting-room hardware, Azure CLI usage, developer tools, and some administrative workflows may rely on it. Microsoft recommends using report-only Conditional Access first, reviewing sign-in logs for device-code-flow use and sessions whose original transfer method was device-code flow, then moving approved exceptions into narrowly scoped groups.
The common failure mode is a broad exception created for convenience. If a large population of ordinary employees remains exempt because a small number of devices require device-code flow, the control does little to reduce the phishing exposure. Exceptions should be tied to named accounts, specific devices or resource accounts, an owner, and a review date.
Organizations should also verify that their public-network posture is enforced rather than merely suggested. Corporate devices should automatically classify hotel and other public Wi‑Fi as public networks, block unsolicited inbound traffic, disable sharing features, and restrict automatic connection to remembered wireless networks. Employees should use cellular tethering when the work does not require hotel Wi‑Fi, particularly for privileged administration, executive communications, legal work, source-code access, or incident response.
Hotel and venue operators face a separate but urgent obligation. Captive portals and Wi‑Fi gateways should have management interfaces removed from public exposure, unique administrator credentials, MFA where supported, current firmware, centralized configuration backup, and alerts for DNS-server, DHCP, proxy, and WPAD changes. A gateway that silently begins resolving Microsoft identity domains to unfamiliar addresses should be handled as a security incident, not a guest-support issue.
The public evidence does not establish which hotels remain compromised, how many guests were redirected, or whether the affected gateways were patched after discovery. What it does establish is enough for action: the network users are most likely to dismiss as ordinary travel infrastructure has become a state-linked entry point into Windows endpoints and Microsoft 365 identities.
Microsoft now says the hotel Wi‑Fi activity belongs instead to Storm-2945, which it tracks as part of Midnight Blizzard—the Russian SVR-linked cluster also called APT29 or Cozy Bear. Microsoft also says the operation began in May 2026, reaches organizations beyond hotels and conference venues, and includes malware delivery alongside account theft.
That is more than an intelligence-label correction. It changes the likely stakes for Windows and Microsoft 365 environments: a compromised guest network can become a delivery point for surveillance malware, Entra token theft, and access to corporate mailboxes, not merely a nuisance phishing redirect.
A captive portal becomes the attacker’s control point
The attack does not require exploitation of a traveler’s laptop at the outset. Once an intruder has administrative control of a hotel’s Wi‑Fi gateway or captive-portal appliance, it controls DNS resolution and, in some cases, proxy-related traffic for every device joining that network.ReliaQuest’s investigation found that the attackers could direct legitimate-looking Microsoft 365 sign-in attempts to attacker-controlled web infrastructure. A guest does not need to click a malicious email attachment or follow a suspicious Teams message. Connecting to the network and then attempting to reach corporate mail can be sufficient to put the victim in front of an impersonation page.
This is a particularly awkward attack model for enterprises because the device may appear healthy. Endpoint protection can see the final connection or suspicious downloaded file, but the initial trigger occurs at the network layer—outside the employee’s normal browsing habits and outside the organization’s own DNS infrastructure.
ReliaQuest also observed attempted abuse of Web Proxy Auto-Discovery, or WPAD, in roughly one-third of the cases it examined. WPAD is still relevant to Windows fleets because it can instruct clients to retrieve proxy configuration automatically. On a hostile network, an unexpected WPAD response can broaden the attacker’s ability to direct web traffic, while leaving activity that resembles ordinary HTTPS traffic in local logs.
The practical implication is that IT teams should stop thinking of hotel Wi‑Fi solely as an untrusted internet connection. In this campaign, the network gateway is being used as an active intermediary between the endpoint and Microsoft services.
Microsoft’s attribution contradicts the first APT28 lead
The sharpest discrepancy in the public record is the actor attribution.ReliaQuest’s original reporting said the hotel and conference-center campaign shared techniques with FrostArmada: compromised network devices, altered DNS settings, Microsoft-focused lures, and adversary-in-the-middle account compromise. But it assessed only a low-to-medium-confidence connection to APT28 and stated that it lacked direct technical links such as reused infrastructure, malware, or an operational security failure tying the operators together.
Microsoft’s assessment identifies Storm-2945 within Midnight Blizzard instead and says this campaign is not connected to FrostArmada. Those conclusions can coexist: attackers from separate Russian services can reuse an effective technique, especially one that turns a single poorly protected gateway into access to dozens or hundreds of transient corporate targets.
The distinction matters operationally because APT28 and APT29 are commonly associated with different Russian intelligence services and historically distinct collection priorities. APT28 is generally linked to the GRU, Russia’s military intelligence service; Midnight Blizzard is widely tied to the SVR, Russia’s foreign intelligence service. Microsoft’s Storm-2945 attribution therefore points to a campaign that should be treated as potential state collection activity rather than as a generic criminal credential-theft scheme.
Neither Microsoft nor ReliaQuest has publicly named the compromised hotel brands, gateway vendors, number of affected networks, or the initial vulnerability used to take over the appliances. ReliaQuest said exposed management interfaces and weak or reused administrative credentials were a plausible entry path, but emphasized that it could not confirm that hypothesis because it lacked visibility into the individual gateways.
That missing information leaves hotel operators with an uncomfortable problem. There is no announced patch list to apply, no named appliance family to search for, and no public estimate of how many properties have been remediated. Operators need to assume that internet-exposed management services, reused administrator passwords, and unmonitored DNS configuration changes are the relevant exposure until the vendors or investigators provide more detail.
The campaign adds ClickFix malware delivery to credential theft
Microsoft says the operation was broader than the phishing activity originally described by ReliaQuest. In addition to redirects to Microsoft-themed pages intended to collect device codes and OAuth authorization, Microsoft says Storm-2945 sent some users to malware downloads through ClickFix-style pages.ClickFix is a social-engineering pattern that presents the victim with a fake error, verification step, browser update, or access instruction, then tells them to copy and run a command. The attacker does not need a remote-code-execution flaw in Windows if the user can be convinced to execute the payload locally.
According to Microsoft, the final payloads include CornFlake RAT and CocoShell, a PowerShell-based information stealer, communicating with a previously unseen command-and-control panel called FruitStone. The public reporting does not yet include hashes, file paths, domains, network indicators, persistence mechanisms, or a complete capability breakdown for either payload. That absence means defenders cannot responsibly treat a filename-based antivirus search as a sufficient hunt.
For Windows administrators, the better immediate controls are behavioral:
- Application-control policies should prevent unsigned or unapproved executables, scripts, and installers from running out of user-writable locations such as Downloads, Temp, and browser cache directories.
- Microsoft Defender for Endpoint and equivalent EDR products should be reviewed for PowerShell launched by browsers,
explorer.exe,mshta.exe,wscript.exe, or copied command lines originating from a browser prompt. - Security teams should alert on first-seen executable downloads and unusual PowerShell activity during employee travel, especially when the initiating network is a hotel, airport, conference venue, or other public captive portal.
- Users should be told plainly that a hotel Wi‑Fi sign-in page will never require them to paste a command into PowerShell, Command Prompt, Windows Run, Terminal, or a browser developer console.
Device-code phishing can bypass the user’s MFA expectation
The account-takeover portion deserves separate attention because it exploits a legitimate Microsoft authentication feature rather than necessarily stealing a password.Microsoft Entra device-code flow exists for devices that cannot conveniently display a browser or accept rich text input. An application begins a sign-in flow and shows a code; the user completes authentication elsewhere; the application receives a valid token. In an abuse scenario, the attacker starts the flow, persuades the victim to enter or approve the code, and receives the resulting access token.
ReliaQuest observed device-code-flow abuse on attacker infrastructure associated with the hotel Wi‑Fi campaign. The important consequence is that users can complete real Microsoft authentication and MFA prompts while authorizing an attacker-controlled session. A user who has been trained only to reject unexpected password pages may still fall for this, because the actual sign-in page can be legitimate.
Microsoft’s Entra guidance already classifies device-code flow as high risk and recommends blocking it wherever possible through Conditional Access. That recommendation should now move from a future hardening task to an immediate audit item for organizations with frequent travelers.
Before blocking device-code flow tenant-wide, administrators should identify valid dependencies. Teams Rooms, Android-based Teams devices, shared meeting-room hardware, Azure CLI usage, developer tools, and some administrative workflows may rely on it. Microsoft recommends using report-only Conditional Access first, reviewing sign-in logs for device-code-flow use and sessions whose original transfer method was device-code flow, then moving approved exceptions into narrowly scoped groups.
The common failure mode is a broad exception created for convenience. If a large population of ordinary employees remains exempt because a small number of devices require device-code flow, the control does little to reduce the phishing exposure. Exceptions should be tied to named accounts, specific devices or resource accounts, an owner, and a review date.
Travel policy needs a Windows-specific reset
The immediate defensive priority is to ensure managed Windows devices establish a full-tunnel, always-on VPN as soon as the hotel’s basic access process is complete. Split-tunnel configurations that send DNS or ordinary web traffic directly through the local network leave the gateway positioned to manipulate the connection.Organizations should also verify that their public-network posture is enforced rather than merely suggested. Corporate devices should automatically classify hotel and other public Wi‑Fi as public networks, block unsolicited inbound traffic, disable sharing features, and restrict automatic connection to remembered wireless networks. Employees should use cellular tethering when the work does not require hotel Wi‑Fi, particularly for privileged administration, executive communications, legal work, source-code access, or incident response.
Hotel and venue operators face a separate but urgent obligation. Captive portals and Wi‑Fi gateways should have management interfaces removed from public exposure, unique administrator credentials, MFA where supported, current firmware, centralized configuration backup, and alerts for DNS-server, DHCP, proxy, and WPAD changes. A gateway that silently begins resolving Microsoft identity domains to unfamiliar addresses should be handled as a security incident, not a guest-support issue.
The public evidence does not establish which hotels remain compromised, how many guests were redirected, or whether the affected gateways were patched after discovery. What it does establish is enough for action: the network users are most likely to dismiss as ordinary travel infrastructure has become a state-linked entry point into Windows endpoints and Microsoft 365 identities.
References
- Primary source: Risky Business Newsletters
Published: 2026-08-03T04:01:28+00:00
Risky Bulletin: Russia is behind the recent hotel WiFi hacks
In other news: Anthropic models also did the hacky-hacky; npm adds publish-time malware scanning; Coldcard hacked for $70 million.
news.risky.biz
- Related coverage: igorslab.de
Hotel Wi-Fi as a Phishing Trap: DNS Hijacking on Microsoft 365
ReliaQuest documents compromised hotel gateways that redirect DNS and put Microsoft 365 accounts at risk via device-code phishing.www.igorslab.de - Related coverage: gblock.app
Hotel Wi-Fi Is Rewriting DNS to Steal Your Inbox
You typed the real Microsoft URL yourself. The hotel Wi-Fi gateway rewrote the DNS answer, and one approval tap hands an attacker your mailbox.
www.gblock.app
- Related coverage: cyberunit.com
Hotel Wi-Fi Is Hijacking Microsoft 365 Logins: How to Protect Traveling Teams | Cyber Unit
Since June 2026, attackers have poisoned DNS on hotel and conference Wi-Fi gateways to send guests to fake Microsoft 365 login pages. Here's what happened in plain terms and why traveling teams need an always-on VPN.
cyberunit.com
- Related coverage: computerworld.com
Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts – Computerworld
By compromising captive Wi-Fi gateways instead of user devices, attackers can silently redirect authentication traffic and steal Microsoft 365 credentials.
www.computerworld.com
- Related coverage: threatvectr.com
Hotel Wi-Fi DNS hijack targets Microsoft 365 logins · ThreatVectr
ReliaQuest says attackers with overlaps to APT28 are tampering with hotel Wi-Fi gateways to redirect guests to fake Microsoft 365 login pages and bypass MFA.threatvectr.com - Related coverage: hacksnack.ch
Hotel-WLAN als Falle: Microsoft-365-Konten im Visier – hacksnack
Wer im Hotel oder an Konferenzen ins WLAN einloggt, riskiert mehr als langsame Verbindungen. Angreifer kapern ganze Netzwerk-Gateways und fangen Zugangsdaten ab.hacksnack.ch - Related coverage: learn.microsoft.com
Restrict device code flow for Microsoft Teams devices with Conditional Access - Microsoft Entra ID | Microsoft Learn
Use Conditional Access to block device code flow by default and grant persistent, account-based exceptions for Microsoft Teams device resource accounts.learn.microsoft.com - Related coverage: learn.microsoft.com
Authentication flows as a condition in Conditional Access policy - Microsoft Entra ID | Microsoft Learn
Learn how authentication flows provide a seamless experience across all application and device typeslearn.microsoft.com
