website // resources

Table of contents

What happened
Where Outtake could have helped
Sources
Book a demo
Back to articles

CaptiveCrunch hotel phishing returns

What happened

CaptiveCrunch hotel phishing is active again, according to an October 5 update from Microsoft Threat Intelligence. Microsoft says it observed Storm-2945 resuming the campaign on September 29, 2026, using manipulated network traffic and hospitality captive portals to gain access to targets. A captive portal is the page a guest encounters when connecting to a hotel or similar shared network.

The new development is the campaign's return, not its initial discovery. Microsoft first reported CaptiveCrunch in July, after observing hospitality-network traffic manipulation since early May. Its October update also reports a Rust variant of the CornFlake information stealer and adds more recent infrastructure indicators, detections, and hunting guidance.

Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard. That attribution is Microsoft's assessment, rather than a conclusion independently established by Outtake. The October update does not provide a new victim total or a quantified loss figure.

The network becomes the delivery channel

The earlier investigation explains how the campaign operates. Attackers manipulate DNS and HTTP traffic on affected networks to redirect users through infrastructure they control. Some destinations imitate Microsoft online services. Others present supposed browser updates, operating-system updates, or connection-repair instructions that lead users toward malware.

This matters because the suspicious interaction can begin while someone is trying to get online, without a phishing email. ReliaQuest's July 23 investigation independently documented compromised hospitality gateways, Microsoft-impersonating domains, and device-code flow abuse. That earlier research corroborates the mechanism, not the newly reported September resumption.

In the device-code branch, a user may reach a legitimate Microsoft authentication page and enter a code supplied by the attacker. Completing that process can authorize the attacker's session. The real sign-in page does not make the preceding request trustworthy. Microsoft describes this technique separately from the malware-delivery branch; the available evidence does not mean every target experienced both.

Why removing one destination is not enough

Microsoft says continued access to upstream hospitality service providers likely enabled the rapid return. It links that assessment to Black Lotus Labs' August research, which assessed with moderate confidence that attackers had compromised multiple managed service providers before targeting downstream networks.

Those are qualified assessments. Microsoft's report says the initial compromise vector for the captive-portal networks remains under investigation. It would be misleading to turn the reported relationships into a confirmed account of how every hotel was compromised.

For enterprise defenders, the distinction is practical. A deceptive domain is an external asset that may support an abuse report. A compromised hospitality gateway is a separate access problem. Disabling the former does not prove the latter has been fixed.

Where Outtake could have helped

The following is a hypothetical application of Outtake's documented capabilities. It does not imply that affected organizations use or lack Outtake, or that Outtake would have prevented these attacks.

Investigate the impersonation outside the network

Outtake Brand Protection describes detection of lookalike domains and visual brand abuse, plus investigation of shared hosting, registration patterns, and connected assets. In a case like CaptiveCrunch, those capabilities could support investigating an observed deceptive destination and checking whether related infrastructure is participating in the same operation.

A useful starting signal could be an authorized report of an unexpected portal redirect, with its URL, timestamp, and safely captured page evidence. Investigators could distinguish the legitimate service being impersonated from the domain delivering the deceptive request, then examine supported infrastructure connections.

Shared hosting alone would not establish common control. Nor should a defender assume that an external monitoring service can see traffic inside a hotel's network. Visibility into the reported destination, or a supplied incident artifact, would be necessary. Content restricted to particular visitors or networks could limit what an outside investigation can verify.

Support scoped disruption and track recurrence

Where evidence establishes actionable impersonation or malicious hosting, Outtake's documented remediation workflows could support reports and escalations to the providers able to act. Its platform description includes evidence packaging, automated reporting, platform escalation, and verified takedown.

For this campaign, the response would need to distinguish attacker-controlled assets from legitimate services being abused. Reporting a malicious destination is not a reason to seek removal of Microsoft's legitimate authentication service or an unrelated customer sharing a hosting address.

Successful action against a confirmed deceptive asset could reduce exposure through that destination. The campaign's return also illustrates why investigators should retain earlier evidence and look for replacement infrastructure rather than treating one removed URL as closure. Outtake's phishing takedown guide makes that distinction between a submitted report, verified removal, and recurrence monitoring.

Keep the control boundary clear

External investigation and disruption would complement, not replace, remediation of compromised gateways, endpoint investigation, and identity controls. They would not revoke stolen sessions, remove malware from a traveler's laptop, or restore a service provider's systems by themselves.

Microsoft's advisory addresses those separate defenses, including trusted connectivity, restrictions on device-code flow where it is unnecessary, and caution around software or repair prompts delivered through captive portals. Provider cooperation, authorization, evidence quality, and the attacker's ability to change infrastructure all affect what an external response can achieve. No case-specific prevention rate or response time can be inferred from the available reporting.

Sources

Sources reviewed October 6, 2026. The September resumption and Rust variant are attributed to Microsoft's October update; the earlier independent research does not establish the scale of the renewed activity.