Midnight Blizzard Hijacks Hotel Wi-Fi in CaptiveCrunch

Microsoft attributes the CaptiveCrunch campaign to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard, which compromised hotel and conference Wi-Fi captive portals to redirect travelers to fake Microsoft 365 logins and deliver CornFlake and CocoShell malware. The campaign has been active since early May across several countries.