CaptiveCrunch targets travellers through hospitality networks

Microsoft’s July report attributes CaptiveCrunch activity to Storm-2945, a sub-cluster of Midnight Blizzard. Researchers described targeted traffic manipulation involving hospitality networks and captive portals, with activity observed since early May. The campaign sought malware delivery and credential theft.

An October update said Microsoft observed the campaign resume in late September and connected the renewed activity with continued access through hospitality service providers. Those follow-up observations are later than the initial July report. The case places the risk beyond a single malicious email: the network infrastructure serving a traveller can alter what appears during connection. Microsoft supplies the attribution and observed chronology; the report does not claim every hotel portal is compromised.