A routine connection to hotel Wi-Fi can end in the theft of corporate email, passwords, and sensitive files - all before the traveler ever clicks a suspicious link. In the CaptiveCrunch campaign, threat actors compromise guest network gateways and redirect connected devices to phishing pages or malware-serving infrastructure. Scope and Timeline of the Campaign Attacks against Wi-Fi networks began in early May 2026 and have since affected multiple countries.

At a glance Actor Unnamed operator; ReliaQuest notes tradecraft similar to APT28 (Fancy Bear, Forest Blizzard) but does not attribute the campaign Activity type Gateway compromise, DNS poisoning, adversary-in-the-middle credential harvesting, device-code flow abuse Targets Traveling corporate employees on hotel and conference center Wi-Fi Scale

Volexity claims the StormBamboo group compromised an ISP to push malicious software updates to customers