Travel and connectivity
The Hotel Wi-Fi Captive Portal Scam
Updated 12 November 2026
A captive portal is the page that appears when you join hotel or conference Wi-Fi. In 2026 Microsoft described a campaign in which attackers abused those networks to send travelers to fake sign-in pages and fake update prompts. The warning for ordinary travelers is simple: a Wi-Fi page should never need you to download or run anything.
What Microsoft reported
On 31 July 2026 Microsoft Threat Intelligence published a report on a campaign it calls CaptiveCrunch. It says that since early May 2026 an actor has manipulated DNS and HTTP traffic on networks served by captive portals, mainly in hotels, conference centers and other shared venues. Microsoft attributes it to a group it tracks as Storm-2945, which it assesses is a sub-cluster of Midnight Blizzard, an actor the US and UK governments attribute to Russia's foreign intelligence service. Other outlets describe the group differently, and Microsoft has said it does not yet know how the portal equipment was first compromised, so the attribution is Microsoft's assessment, not a settled fact. Microsoft's post has been updated since publication and says the actor resumed activity on 29 September 2026.
According to Microsoft, the stated aim is access to the accounts of corporate travelers. That does not make the prompts harmless to anyone else: they are built to get a person to hand over a sign-in or run something on their own device. Malwarebytes summarized the report on 4 August 2026.
What travelers saw
Microsoft lists several things that can appear after you connect:
- A fake browser or operating system update prompt, triggered by the automatic connectivity check your device runs on joining a network.
- A ClickFix-style prompt, for example a "driver repair" tool that asks you to paste and run a verification script in Windows Terminal.
- A fake update window telling you not to turn off your computer. On Android, instructions to download and install an APK file.
- A fake Microsoft 365 sign-in page, or a page asking you to enter a device code on a real Microsoft sign-in page.
Microsoft says the malware delivered includes a Windows remote access trojan it calls CornFlake and an infostealer called ChocoShell. A real captive portal asks you to accept terms or enter details such as a room number. As Malwarebytes puts it, you should never have to download anything just to log into Wi-Fi.
How to protect yourself
- Use your phone's hotspot or mobile data for banking, work and email when you can. Microsoft advises treating hotel, conference and airport Wi-Fi as untrustworthy.
- If you must use the hotel network, complete the portal login first, then start a VPN before opening other sites, as Malwarebytes advises. A VPN does not stop you following a fake prompt.
- Never install updates, certificates or "fixes" offered by a captive portal or a pop-up. Get updates from your device's own settings.
- Never paste and run a command or script because a web page tells you to.
- Do not sign in to Microsoft 365, Google or work accounts on a page you reached through the portal. Go to the site from your own bookmark. Be suspicious of any unexpected device code request, and see our page on device code phishing.
- Check the portal's certificate warnings. Malwarebytes lists mismatched host names, untrusted issuers and plain HTTP as warning signs, though some genuine portals use plain HTTP too, so this alone does not settle it.
- Share as little as you can with a guest-network sign-up page, and avoid reusing work credentials on it.
The campaign works through compromised portal equipment, so the network name matching the hotel's does not prove the portal is safe. Judge the page by what it asks you to do.
If you already clicked, installed or typed something
- Disconnect from the Wi-Fi and switch to mobile data.
- If you ran a command or installed a file, treat the device as compromised. From a different, trusted device, change the passwords for your email and any account you use on it. Run a security scan on the affected device, and ask a professional or your IT team before you trust it again. If it is a work device, tell your IT team the same hour.
- If you typed a Microsoft or Google password, or entered a device code, change that password from a trusted device and review the account's recent sign-in activity and security settings, for example at account.microsoft.com/security.
- If you typed a card number, call the number on the back of the card. See what to do after typing a card on a fake site.
- Report it. Tell the hotel or venue, and file at ReportFraud.ftc.gov or ic3.gov.
Quick answers
- Can a hotel Wi-Fi portal ask for my card details?
- Some venues sell paid Wi-Fi tiers, so a payment request alone does not prove a scam. A request to install software, run a command or enter a code is a different matter: real portals do not need that. If in doubt, disconnect and use your phone's hotspot.
- I typed my card into a hotel Wi-Fi page by mistake. What now?
- Call the number on the back of the card, say you used it on a page you now believe was fake, and ask the issuer what it needs. Our page on typing a card on a fake site covers the first hour.
- Will a VPN protect me from a rogue captive portal?
- A VPN can protect the rest of your traffic once you are online, but it does not stop you from following a fake update prompt or typing a password into a fake page. Malwarebytes advises completing the portal login first and then starting the VPN.
- Is the hotel responsible for a rogue portal?
- We could not find a reliable source on legal liability, so we do not make a claim. Tell the venue what happened and keep a note of the time and what the page asked for.
- How do I know the network name is the real one?
- Ask the front desk. Be aware that in the campaign Microsoft describes, the traffic manipulation happens on the portal network itself, so the right name does not prove the prompts are safe.
This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.