CaptiveCrunch Malware Campaign Hijacks Hotel Wi-Fi Worldwide

Microsoft and ReliaQuest report that a Russia-linked group tracked as Storm-2945 has been manipulating captive-portal Wi‑Fi at hotels and conference venues since May 2026 to push fake updates (CaptiveCrunch), delivering a Go-based RAT and an in-memory PowerShell credential stealer to harvest corporate credentials and Microsoft 365 tokens; the activity is assessed as part of a broader espionage campaign attributed to Midnight Blizzard with guidance provided for detection and mitigation.