BreachPublished 4 Aug 2026

Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

Source Bleeping Computer

Description

Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. [...]

Impact

The campaign enables attackers to gain persistent remote access to infected Windows systems, steal Microsoft 365 credentials and session tokens, browser cookies, saved passwords, and Wi-Fi credentials, and conduct surveillance via keylogging, screenshots, microphone, and webcam capture. This compromises user accounts and sensitive data, potentially leading to unauthorized access to corporate resources. The manipulation of DNS and HTTP traffic on hospitality Wi-Fi networks facilitates large-scale credential theft and malware deployment. The presence of a web-based management panel allows attackers to control infected hosts extensively.

Defensive guidance

Microsoft recommends treating hotel and conference Wi-Fi networks as untrusted environments. Use private cellular or managed network connections whenever possible. Avoid installing software updates or tools offered through captive portals. Adopt phishing-resistant authentication methods such as multi-factor authentication (MFA) and passkeys. Disable Microsoft Entra device code authentication if it is not required. Avoid using corporate credentials on guest Wi-Fi networks. There is no vendor advisory indicating an official patch; therefore, follow these mitigation steps to reduce risk.

References

bleepingcomputer.com/news/security/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Aug 2026, 00:33 UTC

References

Community reviews

Related threats