Business travellers connecting to hotel and conference Wi-Fi networks are facing a new cybersecurity threat, with Microsoft warning of an advanced campaign designed to steal login credentials and compromise corporate devices.
The company says attackers are exploiting public internet access points to lure users into revealing Microsoft 365 account details or downloading malicious software.
According to Microsoft’s threat intelligence researchers, the campaign targets users immediately after they join a hotel’s captive Wi-Fi portal. Instead of being directed to legitimate sign-in pages, victims may encounter convincing fake Microsoft 365 login screens or pop-up messages prompting them to install browser or system updates. These fraudulent prompts are intended to harvest credentials or infect devices with malware.
Microsoft believes the activity is linked to a Russian state-backed cyber espionage group known as Storm-2945, which is associated with the larger Midnight Blizzard operation. The campaign reportedly focuses on business travellers from industries such as finance, healthcare, legal services, retail and energy, where access to corporate accounts can yield valuable information.
Once a device is compromised, attackers may gain the ability to steal sensitive files, monitor user activity, capture keystrokes and maintain long-term access to enterprise networks. Microsoft also noted that elements of artificial intelligence are being used to make the attacks more convincing and scalable.
The company is advising travellers to exercise caution while using public Wi-Fi. Users should verify website addresses before entering credentials, avoid installing software prompted by unfamiliar networks, enable multi-factor authentication, use a trusted VPN wherever possible, and access Microsoft services through official apps or bookmarked websites rather than links presented by Wi-Fi portals.
The warning highlights how cybercriminals are shifting their focus from traditional phishing emails to trusted public environments such as hotels and conference venues, where users are more likely to connect quickly without scrutinising network prompts. As business travel continues to rebound, cybersecurity experts stress that vigilance on public networks is becoming just as important as securing office infrastructure.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.