Microsoft Hotel Wi-Fi Warning: What Travellers Should Do Before Logging In
Microsoft says a Midnight Blizzard-linked campaign is abusing captive-portal networks at hotels and shared venues to push fake updates, phishing flows and malware at travellers.
Quick takeaways
- Microsoft says Storm-2945, assessed as a Midnight Blizzard sub-cluster, has targeted travellers through captive-portal and hospitality networks since early May 2026.
- The campaign can redirect users to fake Microsoft sign-in flows, device-code phishing, fake browser or operating-system updates and ClickFix-style commands.
- A VPN is useful once you are connected to an untrusted network, but it cannot make a fake update prompt, phishing page or malware download safe.
What happened?
Microsoft Threat Intelligence published details of a campaign it calls CaptiveCrunch on 31 July 2026. Microsoft says Storm-2945, which it assesses as an operational sub-cluster of Midnight Blizzard, has been manipulating traffic on networks served by captive portals worldwide, with hospitality-sector and traveller networks a key focus.
The practical risk is familiar to anyone who has used hotel Wi-Fi: you join a guest network, pass through a login or captive portal, and trust that the page in front of you belongs to the venue. Microsoft says this campaign can abuse that moment to redirect users toward actor-controlled infrastructure, fake Microsoft domains, device-code authentication flows, fake browser or operating-system update prompts and ClickFix-style instructions that pressure the user into running commands.
Why travellers should care
This is not a generic warning that every hotel network is compromised. It is a reminder that shared venue Wi-Fi creates a higher-trust moment for attackers: travellers expect captive portals, pop-ups and connection prompts, so a convincing fake update or Microsoft 365 login page may feel less suspicious than it would at home.
Microsoft says the campaign is aimed at malware delivery and credential or session-token theft. For business travellers, that can mean Microsoft 365 credentials, cloud sessions and corporate files. For ordinary travellers, the same playbook can still matter because fake updates, APK prompts and phishing pages can expose email, banking, social and travel accounts.
What you can do now
Treat hotel, airport, conference and café Wi-Fi as untrusted. Avoid installing software, browser updates, security tools, drivers or Android APKs because a public Wi-Fi portal tells you to. If your device says an update is needed, disconnect from the guest network and use the operating system's own update app, the official app store, your mobile data connection or a trusted hotspot.
When signing in to Microsoft, Google, Apple, banking or work accounts, type the address yourself or use a saved bookmark instead of following captive-portal links. Be especially wary of device-code login prompts that ask you to enter a code on another site unless you initiated that flow yourself. Use MFA, but remember that some phishing kits target tokens and device codes rather than just passwords.
Where a VPN helps — and where it does not
A reputable VPN can help once you have a real internet connection by encrypting traffic between your device and the VPN server, reducing what the local Wi-Fi operator or a malicious hotspot can observe or tamper with. That is one reason VPNs are still sensible for travel, especially on networks you do not control.
But a VPN is not a licence to click through warnings. It will not make a fake Microsoft login page genuine, stop you from pasting a malicious command, verify a software update, or remove malware after installation. The safer sequence is: connect only to the expected network, complete the minimum captive-portal step, start your VPN, and refuse unexpected update or login prompts.
VPN Rocks view
The honest travel-security message is layered. A VPN is valuable on public Wi-Fi, but it is not the only layer and it is not the first decision. If a network pushes a download, an APK, a device-code sign-in or a strange Microsoft login flow, the right answer is to stop, switch networks and verify through official channels.
For frequent travellers, the practical upgrade is boring but effective: keep devices patched before departure, use a password manager, enable phishing-resistant MFA where available, carry a mobile hotspot option, and use a trusted VPN after connection rather than treating hotel Wi-Fi as safe by default.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.