Microsoft researchers report a threat group is infecting hotel Wi-Fi networks with custom malware, CaptiveCrunch, to steal guests’ Microsoft 365 credentials and session cookies when they connect through captive portals. The attackers reportedly compromise routers and access points, inject malicious JavaScript into captive portal pages, and capture authentication tokens. Stolen cookies allow unauthorized access to corporate email, documents, and other cloud resources without needing passwords. Microsoft has updated detections and is notifying affected customers, while urging organizations to enforce multifactor authentication and conditional access policies. Security experts recommend using VPNs, avoiding sensitive logins on public Wi-Fi, and monitoring accounts for suspicious activity.
This update represents a notable development in the Ai sector. Organizations and founders tracking this space should evaluate potential strategic and technical implications on their operations.