Microsoft has warned of a new cyberattack by Russian hackers via Wi-Fi
Microsoft has uncovered a new espionage campaign by the Russian group Midnight Blizzard. Hackers gain access to Wi-Fi networks in hotels and conference centers to steal passwords, files, and user accounts.
Russian hackers have changed their attack tactics
According to Microsoft Threat Intelligence, the campaign, dubbed CaptiveCrunch, is being carried out by the Russian group Midnight Blizzard, also known as NOBELIUM or Cozy Bear. It has been ongoing since at least May of this year and primarily targets government agencies, diplomatic missions, non-governmental organizations, and IT service providers in the U.S. and Europe.
Instead of launching direct attacks on corporate networks, the hackers gain control of legitimate Wi-Fi networks in hotels, conference centers, and other hospitality venues. Once users connect, they are shown fake login pages or messages claiming that a Windows or browser update is required.
How the infection scheme works
In reality, these “updates” install the CornFlake and ChocoShell malware, which use the ClickFix social engineering technique.
How to protect yourself from attacks
According to Microsoft, this software is capable of stealing Microsoft 365 credentials, passwords, files, and cookies, as well as providing remote access to the infected device. Additionally, it can record keystrokes and activate the user’s microphone and camera. In some cases, the attacks also targeted Android devices.
Experts emphasize that the threat extends beyond hotels. According to Michael Centrelli, head of public policy at SecurityScorecard, similar attacks could spread to any facility with Wi-Fi login portals, including airports, universities, and medical institutions.
Microsoft recommends against installing software updates via pop-up windows or web pages after connecting to public Wi-Fi networks. The company advises using only official operating system update mechanisms, carefully verifying login pages, using personal mobile hotspots or corporate routers whenever possible, and employing multi-factor authentication and VPNs.
This was reported with reference to Cybernews.
Microsoft is laying off thousands of employees due to AI-related costs.
The Kremlin has issued guidelines on how to report on the gasoline shortage.
The fuel crisis in Russia is worsening: gasoline is running out at gas stations and lines are growing.
Russia has allowed lower-quality gasoline due to the fuel crisis.
