CaptiveCrunch Campaign Abuses Hotel Wi-Fi to Target Travelers
A Russian threat group, dubbed CaptiveCrunch, is exploiting compromised hotel Wi-Fi networks to steal credentials and deliver malware to unsuspecting travelers.
Microsoft has issued a warning regarding the "CaptiveCrunch" campaign, a sophisticated operation orchestrated by a Russian-linked threat group that targets travelers by compromising public Wi-Fi networks commonly found in hotels, conference centers, and other hospitality venues. The campaign transforms the routine act of connecting to a hotel's Wi-Fi into a potential vector for corporate account and device compromise.
Attackers position themselves within the network path, intercepting and manipulating DNS and HTTP traffic originating from captive portals. This allows them to redirect users to malicious phishing pages designed to harvest credentials, device codes, or OAuth tokens. A common tactic involves presenting fake login prompts, such as those mimicking Microsoft authentication pages, to trick users into divulging sensitive information.
Beyond credential theft, CaptiveCrunch also serves as a distribution channel for malware. Users may be presented with deceptive pop-ups masquerading as legitimate software updates or system fixes. These prompts are engineered to trick users into downloading malicious payloads, typically a combination of a remote access trojan (RAT) and an information-stealer.
Among the malware strains identified in these attacks is CornFlake, a RAT capable of capturing sensitive data like webcam imagery, microphone audio, and keystrokes. Complementing this is ChocoShell, a fileless PowerShell-based infostealer that specifically targets browser session cookies, stored passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems.
Microsoft has detailed a series of deceptive dialogs users might encounter, including fake Windows Update windows, bogus Windows Security virus scans, and fraudulent installers for DirectX, Visual C++ redistributables, or even browser and PDF viewer updates. These prompts are designed to appear legitimate and urgent, pressuring users into action.
To mitigate these risks, security experts recommend several precautions. Utilizing a personal mobile hotspot instead of public Wi-Fi significantly reduces exposure. If public Wi-Fi is unavoidable, users should connect to the portal, then immediately launch a VPN with a kill switch feature before accessing any websites or applications. This ensures that if the VPN connection drops, all internet traffic is blocked, preventing potential man-in-the-middle attacks.
Users should also exercise extreme caution when interacting with captive portal pages. Inspecting website certificates for discrepancies, avoiding untrusted issuers, and being wary of plain HTTP connections are crucial. Providing fake or throwaway email addresses for registration is advised, and users should never be required to download software to connect to Wi-Fi.
Finally, maintaining up-to-date anti-malware solutions with web protection, avoiding the direct entry of high-value credentials into captive portal-redirected pages, and ensuring all operating systems and software are updated before travel can further bolster defenses against the CaptiveCrunch campaign and similar threats.