Hotel Wi-Fi Attacks Target Las Vegas Business Travelers

What Is CaptiveCrunch, and Why Should Las Vegas Businesses Care?

On July 31, 2026, Microsoft Threat Intelligence disclosed an ongoing campaign it calls CaptiveCrunch — a hotel Wi-Fi security threat in which attackers took control of the captive-portal equipment that powers guest Wi-Fi at hotels and conference venues in multiple countries. Microsoft attributes the activity to Storm-2945, an operational sub-cluster of Midnight Blizzard — also tracked as APT29 or Cozy Bear — which the U.S. and U.K. governments have formally attributed to Russia’s Foreign Intelligence Service, the SVR.

The campaign has been running since at least early May 2026, and it is not aimed at the hotels themselves. It is aimed at the Microsoft 365 accounts of the business travelers who connect to that Wi-Fi. That distinction matters enormously for a city like Las Vegas, which hosts more trade shows and conventions than anywhere else in the country. Every executive checking email from a Strip hotel room, every sales rep logging into a client portal from a convention center lobby, and every out-of-town vendor visiting a Las Vegas gaming or hospitality business is connecting through exactly the kind of network this group has learned to compromise.

How the Attack Works

CaptiveCrunch is technically sophisticated, but the entry point is something every business traveler does without thinking — clicking “Connect” on a hotel Wi-Fi splash screen. Here is what happens on a compromised network:

• Infrastructure-level compromise: attackers gained control of the shared equipment behind captive portals, not individual hotel networks, giving them reach across many properties from a single foothold.
• DNS and HTTP traffic manipulation: before the real login page ever loads, the attackers redirect the guest’s traffic through an adversary-in-the-middle position they control.
• Fake Microsoft 365 sign-in pages: victims are shown a convincing Microsoft login prompt that captures both the password and the live session token — the token that normally proves MFA was already completed.
• Device code phishing: some victims are shown a legitimate-looking Microsoft device authentication code and told to enter it at the real microsoft.com sign-in page — unknowingly authorizing the attacker’s device instead of their own.
• Fake update prompts (ClickFix): other victims are served a fake browser or OS update that installs the CornFlake remote access trojan and the ChocoShell PowerShell infostealer, giving attackers persistence and ongoing data collection.

• ⚠Traveling executives and sales staff risk their entire Microsoft 365 account — email, SharePoint, Teams — being silently taken over mid-trip.
• ⚠A stolen session token bypasses MFA entirely — resetting the password afterward does not undo the damage already done.
• ⚠Out-of-town clients, vendors, and partners visiting Las Vegas conventions connect through the same compromised hospitality infrastructure as everyone else.
• ⚠A hijacked executive inbox is a proven launchpad for wire-fraud and vendor-impersonation schemes aimed at the business back home.
• ⚠Gaming, hospitality, and legal firms with staff traveling to industry events carry outsized exposure, given how much Las Vegas business runs through the convention calendar.

Three Fixes Before Your Next Business Trip

Defending Las Vegas with CMIT Solutions
Las Vegas runs on its convention calendar, which means Las Vegas businesses are exposed on both ends of a threat like CaptiveCrunch — through employees who travel to industry events, and through the out-of-town clients, vendors, and partners who fly in and connect from Strip and convention-area hotels. CMIT Solutions of Las Vegas configures Conditional Access, phishing-resistant MFA, and travel-safe VPN policies for Clark County businesses in gaming, hospitality, healthcare, and legal — the industries most likely to have people on the road, or hosting the people who are.