That Free Hotel Wi-Fi Could Be Spying on You

Robert Moore · 2026-08-01

You're sitting in a hotel lobby, sipping overpriced coffee, and your browser pops up with a notification: "Update available." You click it without thinking. Who wouldn't? It looks legitimate. But here's the uncomfortable truth: that simple click might just have handed a hacker the keys to your webcam, your microphone, and every keystroke you type. Microsoft just dropped a report detailing a nasty new campaign called CaptiveCrunch. It's delivered through hijacked hotel Wi-Fi networks, and it's pushing fake browser updates that install something called CornFlake — a remote access trojan (RAT) that can do some seriously creepy stuff. We're talking webcam capture, microphone recording, and full keystroke logging. That means passwords, credit card numbers, private messages — all of it, up for grabs. ### What Exactly Is CornFlake? CornFlake is not your run-of-the-mill malware. It's a sophisticated RAT that gives attackers remote control over your device. Once it's in, it can: - Turn on your webcam without you knowing - Record audio through your microphone - Log every keystroke you make - Steal files and credentials from your system - Persist across reboots, making it hard to shake off The scariest part? You might not even know it's there. It runs quietly in the background, doing its dirty work while you go about your day, completely unaware. ### Who's Behind This? Microsoft's researchers are tracking this operation as CaptiveCrunch and attributing it to a group called Storm-2945. They believe Storm-2945 is an operational sub-cluster of Midnight Blizzard — a well-known threat actor with deep ties to Russian intelligence. This isn't some script kiddie messing around. These are professionals with resources, patience, and a clear agenda. ### How Does the Attack Work? Here's the playbook: attackers compromise the hotel's Wi-Fi router or set up a rogue access point that mimics the legitimate one. When you connect, they intercept your traffic and inject a malicious script that redirects you to a fake browser update page. The page looks like the real deal — same logos, same design, same language. But the "update" you're downloading is actually the CornFlake trojan. It's a classic man-in-the-middle attack, but executed with a level of polish that makes it dangerously effective. And hotels are the perfect hunting ground. Travelers are tired, distracted, and just want to get online. They're not thinking about digital security — they're thinking about that meeting tomorrow or calling home. ### Why Should You Care? You might be thinking, "I don't stay in hotels that often." Fair enough. But here's the thing: this attack vector isn't limited to hotels. Any public Wi-Fi — airports, coffee shops, conference centers, even libraries — can be compromised the same way. The technique is transferable, and you can bet other threat actors are watching and learning. ### How to Protect Yourself Now, before you start panicking, let's talk about what you can do to stay safe. It's not all doom and gloom. - **Never click on browser update prompts** — especially on public Wi-Fi. Legitimate browsers update automatically or through their own built-in mechanisms, not through random pop-ups. - **Use a VPN** — a good VPN encrypts your traffic, making it much harder for attackers to intercept and manipulate what you're sending and receiving. - **Verify the network** — ask the front desk for the exact Wi-Fi network name. Don't just connect to the first open network you see. - **Keep your software updated** — the irony isn't lost on me, but updating your browser and OS through official channels (like your device's settings) actually protects you from fake updates. - **Use your phone's hotspot** — if you're handling sensitive work, skip the hotel Wi-Fi entirely and tether to your phone instead. ### The Bottom Line Public Wi-Fi is a convenience we all rely on, but it comes with real risks. This CaptiveCrunch campaign is a stark reminder that the bad guys are always innovating, always looking for new ways in. The good news? You don't have to be a cybersecurity expert to protect yourself. Just a little awareness and a few good habits can go a long way. So next time you're traveling and that update notification pops up, remember: it might not be your browser talking. It might be someone else entirely. And that's a conversation you don't want to have.