Hotel Wi-Fi Fake Update Attacks: How Travelers Stay Safe

What Microsoft reported about CaptiveCrunch

In a July 31, 2026 threat-intelligence report, Microsoft said it had observed Storm-2945 manipulating DNS and HTTP traffic from networks served by captive portals since early May. Microsoft assesses Storm-2945 to be a sub-cluster of Midnight Blizzard, a Russia-based cyberespionage actor.

Microsoft observed affected hospitality networks in several countries and said other researchers identified activity at hotels, conference centers and shared venues. The company was still investigating how the captive-portal networks were initially compromised. Similar equipment and management systems across affected networks suggested the campaign might involve shared parts of the captive-portal ecosystem rather than only isolated venue compromises.

How a legitimate guest network can become the trap

A classic evil-twin attack lures people onto a fraudulent hotspot that copies a trusted name. CaptiveCrunch is different. Microsoft says the attackers gained a position that allowed them to manipulate traffic on networks served by real captive-portal infrastructure.

The attack path in plain language

1. You join guest Wi-Fi. Your browser or operating system performs an automatic connectivity check to discover whether a sign-in portal is required.
2. Traffic is redirected. The manipulated network sends the device toward attacker-controlled infrastructure instead of the page it expected.
3. A convincing prompt appears. It may pretend to be a browser update, operating-system repair, security check or failed verification.
4. The user completes the attack. The page asks for a download, an installation, a pasted command or a device code entered on a legitimate Microsoft sign-in page.

That last step matters. Many modern attacks do not break encryption directly; they manufacture enough urgency and familiarity to persuade the person to authorize the next action.

Fake updates and device-code phishing

Microsoft found malware presented as browser or operating-system updates. The reported Windows implant could steal credentials and session tokens, log keystrokes, collect files, take screenshots and provide remote access. Microsoft also saw indications that some landing pages instructed Android users to install an APK.

The report did not describe equivalent malware for iPhone or Mac. Apple users should still reject the same social-engineering pattern. A fake portal can try to steal a password, request a configuration profile, send a user to a fraudulent sign-in page or persuade someone to approve an authentication flow.

Why a real Microsoft page can still be part of phishing

In device-code phishing, an attacker starts an authentication request and convinces the victim to enter the attacker's code on a legitimate Microsoft page. The domain may be real, but the code links the victim's approval to the attacker's session. Never enter a device code merely because hotel Wi-Fi, a pop-up or an unsolicited message tells you to.

What protects you—and what does not

A VPN is still useful on guest Wi-Fi, but timing and expectations matter. Captive portals often appear before a VPN tunnel can be established. Complete only a portal you have verified with the venue, close the portal, connect Free VPN US, confirm the VPN is active and then start ordinary browsing.

Hotel Wi-Fi checklist for iPhone and Mac

Before joining

• Ask hotel or conference staff for the exact Wi-Fi name and sign-in method. Do not rely on a sign posted where anyone could copy it.
• Prefer your iPhone's cellular connection or Personal Hotspot for banking, work administration and software updates when practical.
• Install important updates before travel through System Settings, iPhone Settings or the App Store.

At the captive portal

• Expect ordinary access details such as a room number, surname, event code or acceptance of terms—not an app, certificate, profile or repair tool.
• Do not use your work or email password as the Wi-Fi registration password.
• Leave immediately if the page asks you to open Terminal, paste a command, disable security, install a profile or enter a Microsoft device code.

After the portal

• Close the captive-portal window and connect Free VPN US before browsing.
• Confirm the VPN shows an active connection. If the Wi-Fi forces the portal to reopen, stop and verify the network with staff again.
• Disable automatic joining for unfamiliar networks and forget the guest network when the trip ends.

What to do if you clicked or installed something

1. Disconnect. Turn off Wi-Fi and stop using the affected device for email, banking or work accounts.
2. Do not keep troubleshooting through the prompt. More instructions may be part of the same attack.
3. Use a clean device. Change any password you entered, revoke active sessions and review MFA methods and recent sign-ins.
4. Escalate work-device incidents. Contact your organization's security or IT team immediately and preserve the page address, time, hotel and network name if safe to do so.
5. Get the device inspected. Unknown software, configuration profiles or commands can require professional cleanup or a full reset.

If you only opened the page and did not download, install, paste, approve or enter credentials, the risk is lower. Still close it, forget the network and report the behavior to venue staff.

Related hotel Wi-Fi guides

How to Use a VPN With Captive Portals

Follow the correct connection order when hotel or airport Wi-Fi requires a browser sign-in.

How Evil-Twin Wi-Fi Hotspots Work

Learn how attackers copy familiar network names and how to verify a hotspot before joining.