ハッカーがホテルや公共Wi-Fiを悪用して旅行者を標的にHackers target travelers through hotel and public Wi‑Fi networks

Microsoft has reported a newly identified attack campaign, tracked under the name CaptiveCrunch, in which the nation-state group Midnight Blizzard abuses the captive portals commonly used by hotel and public Wi-Fi networks to deliver malware and steal credentials from travelers worldwide. The finding matters because captive portals are a routine part of connecting to networks in airports, cafes, conference venues and hotels, and most users interact with them without a second thought, making them an attractive foothold for attackers who want to reach people while they are away from more protected corporate environments.

A captive portal is the web page that intercepts a device the moment it joins a public network, typically prompting the user to accept terms of service, enter a room number, or sign in before internet access is granted. Because the operating system and browser are effectively forced to load whatever content the network presents, the mechanism gives whoever controls the portal a privileged early opportunity to display prompts, request information, or push files. According to Microsoft's account, Midnight Blizzard appears to exploit exactly this dynamic, using the portal stage to serve malicious content and harvest login details from users who assume they are completing an ordinary connection step.

Midnight Blizzard is a well-documented threat actor that Microsoft has previously linked to Russian state interests, and the group is also tracked across the security industry under other names, including APT29, Nobelium and Cozy Bear. It is associated with high-profile espionage operations over the past several years and is generally characterized as a patient, well-resourced actor focused on intelligence collection rather than immediate financial gain. Targeting travelers is consistent with that profile, since people in transit often connect to unfamiliar networks, may relax their usual security habits, and can carry access to sensitive government, corporate or organizational systems.

The campaign fits into a broader category of network-based threats that predate this specific operation. Public Wi-Fi has long been associated with risks such as "evil twin" access points, where an attacker stands up a rogue network that imitates a legitimate one, and with man-in-the-middle techniques that let an intruder observe or alter traffic between a device and the services it contacts. What distinguishes the reported CaptiveCrunch activity is the specific focus on the captive portal itself as the delivery surface, which is likely intended to blend the malicious step into a workflow that users already expect and trust. Exact technical details, including how the group gains its position on affected networks and which malware families are involved, are best confirmed through Microsoft's own reporting.

Credential theft is a recurring objective in campaigns of this kind because stolen usernames and passwords can be reused to access email, cloud services and internal systems, often bypassing the need for additional exploitation. When paired with malware, an initial capture of credentials can support longer-term access and lateral movement inside an organization once the traveler reconnects to trusted networks. This combination is why security teams treat travel scenarios as a distinct risk category, sometimes issuing loaner devices, enforcing stricter sign-in policies, or requiring hardware-based authentication for staff who work abroad.

For individuals, standard precautions remain the most practical defense. Using a reputable virtual private network encrypts traffic even on untrusted networks, while enabling multifactor authentication, and ideally phishing-resistant methods such as passkeys or hardware security keys, reduces the value of any credentials an attacker manages to capture. Users can also be cautious about captive portals that request more than a basic acceptance of terms, avoid entering account passwords or downloading software prompted by a login page, and keep operating systems and browsers fully updated so that known vulnerabilities are patched.

As with any advisory attributed to a single vendor, the primary source should be consulted for indicators of compromise, affected platforms and specific mitigation guidance. Microsoft's disclosure adds to a growing body of research on how sophisticated actors adapt everyday connectivity mechanisms for espionage, and it underscores that the convenience of public and hotel Wi-Fi continues to carry security tradeoffs that both travelers and the organizations they work for need to weigh.