CaptiveCrunch captive-portal hijacking
Attackers manipulate DNS and HTTP traffic on captive-portal networks to redirect travelers into phishing flows and malware delivery.
- Momentum score
- 87
- Impact
- High
- Confidence
- High
What it is
CaptiveCrunch compromises hotel and hospitality sign-in portals, manipulating DNS or web traffic so travelers are redirected to credential theft, session-token theft, or malware delivery. Microsoft observed this campaign from May 2026 and linked it to a Midnight Blizzard subcluster. It combines compromised travel infrastructure with older device-code and OAuth phishing techniques, which the actor had used before moving them into captive-portal workflows.
Why it is rising
Microsoft observed the campaign from May onward and reported Windows malware, credential theft, session-token theft, and signs of Android targeting.
Six-month trajectory
Normalized weekly momentum for prototype validation
+24 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Show why network trust disappears when employees work through captive portals.
- 02Position phishing-resistant access and endpoint controls as complementary defenses.
- 03Create traveler-focused guidance for high-risk roles and mobile workforces.