Storm-2945 Hijacks Hotel Wi-Fi to Target Microsoft 365 Logins

Hackers are tampering with Wi-Fi equipment in hotels and conference centers worldwide, altering Domain Name System settings to redirect business travelers to fake Microsoft 365 login pages and malware downloads. Cybersecurity researchers and Microsoft attribute the active campaign to an operation tracked as Storm-2945, which began exploiting captive portal networks in early May 2026.

Business travelers checking into a hotel or attending an industry conference often connect to local wireless networks assuming standard convenience. Behind the scenes, however, malicious actors are actively subverting those expectations. Cybersecurity firm ReliaQuest and Microsoft Threat Intelligence have uncovered a widespread campaign targeting hospitality networks, conference centers, and shared venues across the United States and multiple international countries.

How Threat Actors Hijack Hotel Wi-Fi Gateways

The attack targets the infrastructure that manages internet access for guests. A Wi-Fi gateway controls how connected devices reach the web. Once attackers gain administrative access to these appliances, they modify the gateway’s Domain Name System configurations. DNS functions essentially as an address book for the internet, translating readable website names into the numerical routing addresses required by servers.

By altering these settings, malicious operators can silently divert traffic when a guest attempts to load legitimate services. The scope of affected organizations spans financial services, professional services, legal, health care, energy, and retail. ReliaQuest researchers observed compromised gateways in several U.S. cities, while Microsoft noted widespread hospitality sector compromises worldwide. This broad victimology confirms the campaign targets traveling employees rather than any single industry vertical.

Phishing for Microsoft 365 Credentials and Bypassing MFA

Once redirected through actor-controlled infrastructure, travelers frequently encounter convincing doppelganger domains mimicking Microsoft online services. ReliaQuest identified at least four fraudulent domains registered for these portals, including m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. A traveler moving quickly between meetings can easily overlook the unusual web address.

Hotel Wi-Fi Attacks Are Putting Microsoft 365 Accounts at Risk

In addition to traditional credential harvesting, attackers leverage sophisticated device code authentication flows. A user reaching a fraudulent page may be presented with an authorization prompt that appears entirely legitimate. Microsoft noted that since February 2026, Storm-2945 has conducted AI-augmented operations utilizing targeted device code and OAuth code phishing campaigns.

When the traveler approves the request, Microsoft issues a valid OAuth token directly to the attacker’s client. This technique successfully bypasses traditional multifactor authentication because the security system registers a valid user approval, even though the threat actor initiated the underlying authentication session.

Malware Delivery via ClickFix Techniques

Beyond credential theft, Microsoft Threat Intelligence observed active traffic manipulation attacks delivering malware to impacted systems. In response to automated connectivity checks issued by browsers, threat actors leverage adversary-in-the-middle positioning to push malicious payloads purporting to be browser or operating system updates.

Storm-2945 Hijacks Hotel Wi-Fi to Target Microsoft 365 Logins — Photo: Microsoft

The operation relies heavily on ClickFix social engineering techniques to trick users into executing downloaded files. Systems targeted include Windows devices, where attackers deliver fully featured remote access trojans compiled in Golang. These payloads provide extensive capabilities, including system enumeration, file and keystroke collection, credential theft, session token extraction, audio and video surveillance, removable media monitoring, and a remote shell. Microsoft also identified indications that attackers target Android devices by directing users to download and install malicious APK files through similar landing pages.

Attribution to Storm-2945 and Midnight Blizzard

Investigators noted tactical and procedural similarities to the Forest Blizzard DNS hijacking operation disclosed publicly in April 2026.

Hotel Wi-Fi phishing attack targets Microsoft 365 business logins — Photo: Foxnews

Midnight Blizzard is a Russia-based threat actor attributed by the United States and United Kingdom governments to the Foreign Intelligence Service of the Russian Federation, commonly known as the SVR. Technical overlaps link Storm-2945 to Storm-2372, another initial access sub-cluster associated with Midnight Blizzard that tracked throughout 2025 for utilizing OAuth code phishing, Microsoft Graph-based email exfiltration, and commercial messaging apps for social engineering.

Securing Corporate Devices While Traveling

While investigators continue examining how attackers initially compromise hospitality captive portal networks, common vulnerabilities include exposed administrative tools, weak passwords, vulnerable web dashboards, and delayed software updates on older appliances. Because hospitality networks traditionally favor guest convenience over rigid security controls, travelers remain exposed whenever they connect away from corporate offices.

Security guidance urges organizations to scrutinize unexpected login prompts, particularly those requesting device code approvals or unexpected software updates while using public Wi-Fi. Utilizing virtual private networks and enforcing robust endpoint detection helps mitigate risks associated with compromised gateway infrastructure.