MEDIUMApt
Global

Midnight Blizzard Targets Travelers via Captive Portals

·Source: Infosecurity Magazine

Updated:

Executive Summary

Russian actor Storm-2945 hijacked hotel captive portals to push fake updates and steal tokens

Analysis

Russian actor Storm-2945 hijacked hotel captive portals to push fake updates and steal tokens
Source Attribution

Originally published by Infosecurity Magazine on Aug 3, 2026.

Related Threats

MEDIUMApt

Russian hackers hijack hotel Wi-Fi networks to spy on travelers, Microsoft says

Russian state-sponsored hackers have been compromising hotel Wi-Fi networks around the world to steal travelers' login credentials and infect devices with espionage malware, Microsoft said.

The Record
MEDIUMApt

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations. The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek .

SecurityWeek
MEDIUMApt

Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to Storm-2945. It assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard, also known as

The Hacker News