Russian Hackers Hijack Hotel Wi-Fi for Passwords

A sophisticated cyber threat is emerging from a suspected Russian hacking group, targeting hotel Wi-Fi networks to pilfer sensitive user information. Microsoft has alerted the public that these compromised networks are rerouting users to deceptive websites mimicking legitimate Microsoft online services, aiming to capture login credentials. The attack extends beyond password theft, as malware is also being distributed under the guise of software updates.

These malicious payloads, including advanced Windows remote access trojans, can enable attackers to steal passwords, exfiltrate files, and remotely control a user's computer. The compromised Wi-Fi systems employ tactics like "ClickFix" attacks, presenting fake CAPTCHA pages or update processes that trick users into executing malicious code. ReliaQuest, a cybersecurity vendor, suspects the involvement of APT 28 or Fancy Bear, while Microsoft points to a subgroup of APT 29, also known as Cozy Bear, both linked to the Kremlin.

To mitigate these risks, Microsoft recommends users exercise caution with hospitality and guest networks. Relying on personal cellular data is advised over hotel Wi-Fi. Users should refrain from downloading any software, updates, or security utilities presented through captive portals or unexpected web prompts. Activating a VPN in full-tunnel mode is also suggested as a measure to block malicious redirects.