iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft says a Russian-linked threat group resumed a campaign that manipulates captive-portal Wi-Fi traffic in hospitality settings and can lead travelers to credential phishing or malware disguised as updates. The report does not name hotel chains, and it does not establish that every hotel or guest network is affected. Treat venue Wi-Fi as untrusted, and never install software or follow command instructions offered by an unexpected portal prompt.
What Microsoft reported about the Wi-Fi attacks
Microsoft Threat Intelligence calls the campaign CaptiveCrunch and attributes it to Storm-2945, which Microsoft assesses to be an operational sub-cluster of Midnight Blizzard. Microsoft describes Midnight Blizzard as a Russia-based threat actor that the US and UK governments attribute to Russia’s Foreign Intelligence Service (SVR). The report attributes activity to threat groups; it does not establish the identities of individual operators.
In an update published October 5, 2026, Microsoft said it observed Storm-2945 resume CaptiveCrunch on September 29. Microsoft first reported the campaign in July 2026, describing targeted traffic-manipulation activity on captive-portal networks worldwide since early May. Its reporting refers to hospitality-related Wi-Fi and other guest networks, but does not name affected hotel brands or give a verified count of compromised venues. It does not show that every hotel, chain, or guest was affected. Microsoft’s CaptiveCrunch report and October update
How a captive-portal attack can reach a traveler
A captive portal is the sign-in or terms page that appears when you join a guest network. Microsoft observed Storm-2945 manipulating DNS and HTTP traffic on networks served by captive portals, redirecting user traffic through infrastructure controlled by the attackers. A portal can look routine and still be part of a compromised network.
#1 Best Overall
- 【Global Seamless Roaming with a Variety of Data Plans】RoamWiFi offers seamless, high-speed connectivity in 170+ countries. Enjoy stable networks worldwide without SIM changes or international roaming fees. We provide diverse data plans for short-term travel to long-term stays. RoamWiFi lets you browse social media, make video calls, and work online worry-free.
- 【Multi-Device Sharing and Intelligent Network Optimization】RoamWiFi supports simultaneous connections for up to 10 devices, including smartphones, tablets, laptops, gaming consoles, etc., providing convenient internet access for your family and friends during travels. Furthermore, equipped with advanced intelligent network selection technology, RoamWiFi automatically detects and connects to the optimal network signal from various carriers to ensure the best online experience wherever you go.
- 【Ultimate Portability and Long Battery Life】 Designed to be compact and lightweight, RoamWiFi is easy to carry, fitting comfortably in your pocket or backpack. Its powerful battery life also means you don't need to charge it frequently, ensuring a prolonged online experience. Whether you're traveling, at home, or gaming, RoamWiFi is your ideal companion.
- 【Built-in Data Plan with 30 Days Validity】 RoamWiFi offers an exclusive built-in data plan that includes 1GB of local data valid across the United States (US), Canada (CA), and Mexico (MEX)
- 【No Contract or SIM Card Required, Easy to Use】RoamWiFi needs no contract or SIM card; just power on for automatic internet connection with no complex settings. Our 24/7 customer support ensures a hassle-free experience. Perfect for travel or daily use, RoamWiFi brings digital convenience to your life. For any issues, please contact our customer service first; we're dedicated to resolving them promptly.
Microsoft has also observed adversary-in-the-middle phishing, including lookalike pages mimicking Microsoft services and abuse of device-code authentication, as well as malware delivery. A fake update page or connectivity check may ask a visitor to download a file or follow ClickFix-style instructions—steps that persuade a person to run commands or software. The reported Windows malware includes remote-access tools with capabilities such as collecting system details, files, keystrokes, credentials, and session tokens; surveillance; removable-media monitoring; and remote-shell access. Microsoft names CornFlake as one Windows remote-access and information-stealing implant, but describes multiple malware variants and techniques, not a campaign consisting only of CornFlake. Microsoft also reports indications of possible Android targeting through instructions to install APK files.
Microsoft says the initial compromise vector for the captive-portal networks remains under investigation. It notes commonalities in some equipment and management systems that could point to shared services in parts of the captive-portal ecosystem; that is not a confirmed explanation for how every affected network was compromised. Microsoft Threat Intelligence’s technical and campaign details
Rank #2
- North America-Exclusive 4G WiFi Device : Designed specifically for users across North America, this portable WiFi device offers seamless, high-speed internet without the need for a physical SIM card. Say goodbye to carrier restrictions and hidden roaming fees—enjoy reliable 4G connectivity wherever you go, with no contracts or commitments. Whether you're on a cross-country road trip or working remotely, this device ensures you stay connected effortlessly.
- WiFi 6 Technology : Equipped with advanced WiFi 6 capabilities, this portable wifi router delivers faster speeds, improved efficiency, and better performance in crowded network environments. This mobile hotspot device supports simultaneous connections for up to 8 devices, making it perfect for families, small teams, or group travelers. Stream, browse, and work without interruptions, even in high-demand situations.
- Portable & All-Day Battery Life : Compact and lightweight at just 100 grams(3.5ounce), this pocket-sized device is easy to carry wherever you go. Despite its small size, it packs a powerful battery that provides up to 15 hours of continuous use on a single charge. Whether you're hiking, camping, or working remotely, you can rely on all-day connectivity without needing to recharge.
- Smart Features for Easy Management : Stay in control of your data usage with the built-in display screen, which shows real-time updates on your remaining data. simply glance at the screen to monitor your usage. Plus, every new hotspot device comes with 10GB of complimentary data, so you can start using it right out of the box,it’s a great way to test the service and enjoy instant connectivity during your first trip or busy workday.
- Perfect for Every Lifestyle : From long-haul truck drivers and frequent travelers to outdoor enthusiasts and business professionals, this versatile mobile hotspot WiFi solution adapts to your needs. Whether you're navigating remote highways, exploring national parks, or managing work on the go, it provides dependable, high-speed internet to keep you connected to what matters most.
Is hotel Wi-Fi safe?
Hotel Wi-Fi is not automatically unsafe, but a familiar network name or convincing sign-in page does not prove that the connection is trustworthy. Microsoft’s practical position is: “When traveling, users should treat hotel, conference, airport, and other guest wireless networks as untrustworthy.” That is a precaution for public and guest networks, not a claim that all such networks are compromised.
For sensitive work, prefer a private connection when practical. A phone hotspot or cellular data through an eSIM reduces reliance on venue Wi-Fi, though coverage and data costs vary. An organization-managed travel router or hotspot may be configured to establish an encrypted tunnel to trusted corporate infrastructure; a consumer travel router does not necessarily do this by default. A VPN can make network eavesdropping harder, but encryption alone does not stop malware installation, phishing, or every form of portal manipulation, and it cannot protect an already infected device.
Rank #3
- 𝐑𝐨𝐚𝐦 𝟔 𝐀𝐗𝟏𝟓𝟎𝟎 𝐝𝐮𝐚𝐥-𝐛𝐚𝐧𝐝 𝐬𝐩𝐞𝐞𝐝𝐬 - Wi-Fi 6 Speeds up to 1,201 Mbps (5 GHz) and 300 Mbps (2.4 GHz) for up to 60 devices simultaneously. Actual Wi-Fi speeds vary based on source bandwidth, environment, distance to devices, and obstacles. ◇§
- 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐝𝐮𝐫𝐚𝐛𝐥𝐞 𝐝𝐞𝐬𝐢𝐠𝐧 - Roam 6 AX1500 is a pocket-sized travel router compactly designed for trips and adventures, featuring a 1 Gbps WAN/LAN port and a 1 Gbps LAN port for reliable wired connectivity.
- 𝗦𝗲𝗰𝘂𝗿𝗲 𝗪𝗶-𝗙𝗶 𝗼𝗻-𝘁𝗵𝗲-𝗴𝗼 - Connects to public Wi-Fi and creates a private, secure network for all your devices. Supports multiple devices at once, ideal for hotels, Airbnbs, airports, and even home use. VPN connectivity enables secure remote work.
- 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐰𝐚𝐲𝐬 𝐭𝐨 𝐜𝐨𝐧𝐧𝐞𝐜𝐭 - (1) Router Mode: Connects to public Wi-Fi, ISP, or phone (USB tethering). (2) AP/RE/Client Mode: Adds WiFi to wired setups, extends WiFi, or connects wired devices wirelessly.
- 𝐎𝐮𝐫 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. Advanced security is integrated into the device’s design, development, and ongoing maintenance.
How to spot a fake hotel Wi-Fi network or unsafe prompt
A fake network may imitate a venue’s name, and an unsafe prompt may appear after joining a legitimate-looking network. Confirm the official Wi-Fi name and connection method with hotel staff or another trusted venue source instead of choosing a similarly named network at random. The FBI’s general hotel Wi-Fi guidance also recommends turning off auto-reconnect so a device does not silently rejoin an unintended network. FBI IC3 hotel Wi-Fi guidance, published October 6, 2020
Stop if a captive portal or unexpected browser page asks you to install a browser or operating-system update, certificate, troubleshooting tool, security utility, or APK, or to run commands. Microsoft specifically describes fake update experiences and ClickFix-style instructions as part of the campaign. Do not treat a prompt as legitimate merely because it uses familiar branding or appears during sign-in; check for updates through your device’s trusted operating-system update mechanism instead.
Rank #4
- 2-in-1 Solution: The SIMO Hero features a powerful hotspot device along with an 5250mAH powerbank built-in. Note: For best results please use the charging cable included.
- Optimized to Share WiFi: Confidently connect up to 10 devices simultaneously.
- SignalScan AI: Easily find the strongest signal across multiple mobile carriers – No SIM and No Locked-In Contracts Needed.
- Global Coverage: SIMO delivers WiFi in 140 countries with 300+ carriers worldwide.
- Two Data Packs Included: Each SIMO device comes bundled with 1GB of Free Data every month, forever (12GB Yearly) along with a one-time 30GB pack of Global Data (30GBs expires in 30 days)
What travelers should do
- Choose private connectivity when feasible. Use cellular data, a phone hotspot, or an eSIM rather than public Wi-Fi when the task is sensitive and coverage allows.
- Verify the network before connecting. Ask the venue for its official network name and sign-in process. Disable auto-reconnect for public networks.
- Refuse unexpected installs and commands. Do not download updates, certificates, browser changes, troubleshooting tools, or security utilities from a portal or unexpected prompt. Use trusted device settings or official vendor channels for updates.
- Limit what you disclose. Avoid reusing corporate credentials on guest-network registration pages, and provide only the personal, employer, or travel details the connection genuinely requires.
- Protect account sign-ins. Use passkeys or multifactor authentication where available. Organizations should restrict device-code authentication to cases where it is necessary and apply suitable identity and access controls.
- For work, follow your organization’s setup. Use its approved VPN or managed travel equipment if required. The FBI recommends a reputable VPN for telework because encryption makes eavesdropping harder; this is general hotel-network advice, not a specific finding about CaptiveCrunch.
- Keep devices patched. The FBI’s 2020 guidance recommends installing security updates and using multifactor authentication for sensitive accounts.
These steps reduce exposure; none guarantees safety on a compromised network or protects a device that already has malware.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteIf you already followed a portal’s update instructions
If you downloaded a file, installed an app or certificate, or ran commands because a guest-network prompt asked you to, disconnect from that network and do not continue entering passwords on pages opened through it. Contact your organization’s IT or security team promptly if the device or account is work-managed, or if you used work credentials. From a trusted connection and device, change passwords for any accounts you entered and review their sign-in and security activity. If you installed software, seek help from your organization or the device maker to assess and remove it; deleting a download alone does not establish that a device is clean.
Quick Recap
Best Value
- 𝐑𝐨𝐚𝐦 𝟔 𝐀𝐗𝟏𝟓𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐓𝐫𝐚𝐯𝐞𝐥 𝐑𝐨𝐮𝐭𝐞𝐫 - Delivers fast Wi-Fi 6 speeds (1201 Mbps on 5 GHz, 300 Mbps on 2.4 GHz) for uninterrupted video streaming, downloading, and online gaming all at the same time. Actual Wi-Fi speeds vary based on source bandwidth, environment, and distance to devices.
- 𝐒𝐞𝐜𝐮𝐫𝐞 𝐖𝐢-𝐅𝐢 𝐎𝐧-𝐓𝐡𝐞-𝐆𝐨 - Connects to public Wi-Fi and creates a private, secure network for all your devices. Supports multiple devices at once, ideal for hotels, Airbnbs, airports, and even home use. VPN connectivity enables secure remote work. This is not a Mi-Fi device or mobile hotspot.
- 𝐂𝐨𝐧𝐧𝐞𝐜𝐭 𝐀𝐧𝐲𝐰𝐡𝐞𝐫𝐞, 𝐀𝐧𝐲 𝐖𝐚𝐲 - Offers (1) Router Mode for Ethernet or USB (phone) tethering connections, (2) Hotspot Mode for secure access to public WiFi , and (3) AP/RE/Client Mode to extend WiFi, add WiFi to wired setups, or connect wired devices wirelessly.
- 𝐏𝐨𝐫𝐭𝐚𝐛𝐥𝐞 𝐚𝐧𝐝 𝐃𝐮𝐫𝐚𝐛𝐥𝐞 𝐃𝐞𝐬𝐢𝐠𝐧 - The Roam 6 AX1500, measuring a compact 4.09 in. × 3.54 in. × 1.10 in., is a pocket-sized travel router perfect for your next trip or adventure.
- 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐰𝐚𝐲𝐬 𝐭𝐨 𝐩𝐨𝐰𝐞𝐫 𝐲𝐨𝐮𝐫 𝐫𝐨𝐮𝐭𝐞𝐫 - Power the Roam 6 via its USB-C port using the included adapter or any 5V/3A PD power source, like a power bank.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
