Russian state-linked hackers have been breaking into hotel Wi-Fi networks around the world to steal data from corporate employees on business trips, according to a report by Microsoft Threat Intelligence released on July 31. Microsoft said it has been monitoring the attacks since early May 2026, while operations by the Storm-2945 group, which is linked to another group known as Midnight Blizzard, began in February.
The hackers intercepted DNS and HTTP traffic on networks that use guest Wi-Fi login pages and redirected users through their own infrastructure (DNS is the system that directs internet traffic to the correct websites, while HTTP is the basic protocol used to load web pages). By posing as browser or operating system updates, the attackers delivered malware to victims. They also used ClickFix techniques — fake error messages that tell users to run a “verification” script — to trick victims into downloading and launching malware.
The attacks were detected not only in hotels, but also in conference centers and other shared venues used by high-profile visitors.
Several tools were used in the campaign. The main one was CornFlake, a remote-access Trojan written in the Go programming language. It records keystrokes, takes screenshots, turns on a microphone and webcam, and steals passwords and session tokens (which can allow access to an online account without requiring a password again).
A second tool, the PowerShell-based ChocoShell infostealer, targeted cookies, saved passwords, Microsoft 365 tokens, and Wi-Fi passwords. Operators controlled infected devices through a web panel called FruitStone. According to Microsoft, artificial intelligence helped carry out a significant share of the operations.
In the U.S. and the UK, Midnight Blizzard has been linked to Russia’s Foreign Intelligence Service, or SVR. The group typically targets governments, diplomatic missions, nongovernmental organizations, and technology companies in the U.S. and Europe. Its goal is to collect intelligence in support of Russian foreign policy.
“Midnight Blizzard is consistent and persistent in their operational targeting, and their objectives rarely change. Their focus is to collect intelligence through longstanding and dedicated espionage in support of Russian foreign policy interests,” the report read.
Anthropic and OpenAI assisted Microsoft with the investigation. There are also signs that the hackers are trying to infect Android devices.
Microsoft advises treating hotel, conference, and airport Wi-Fi as unsafe, using mobile internet where possible and avoiding updates offered through pop-up windows or Wi-Fi login pages.
Earlier, employees of U.S. defense companies and scientists studying nuclear fusion were targeted by Russian hackers from the Laundry Bear group, also known as Void Blizzard. The cybersecurity company Proofpoint reported that their email services had been compromised.
