• Treat hotel Wi-Fi as untrusted, even when the network name is real.
• Never run a command or enter a sign-in code a Wi-Fi page asks for.
• Use a phone hotspot and VPN when public Wi-Fi asks for anything unusual.

Previously in Part Six, Sarah dodged a fake coffee-shop network and caught a padlock vanishing in the airport lounge. One stop to go before her 8 a.m. keynote.

Sarah and her encounters are fictional composites. The attack techniques and the groups behind them are real and documented; sources are linked at the end of each part.

9:20 p.m. | The hotel

A delayed flight and a rental-car line that qualifies as a character-building exercise later, Sarah reaches the hotel with a keynote in eleven hours and the posture of someone who wants nothing but a flat surface. The Wi-Fi name matches the card from the front desk. She opens her laptop, joins, and a familiar page pops up asking for her surname and room number. That page is called a captive portal: the sign-in screen a guest network shows before it lets you online. Hotels, airports, and cafés all use them, so seeing one is completely normal.

She enters both, and then the page changes. “Security verification required.” A window styled like a Windows diagnostics tool: Your connection could not be verified. To repair, press the Windows key and R, paste the command, and press Enter. A helpful button reads “Copy repair command.” Below it: Prefer to verify with Microsoft? Visit the Microsoft sign-in page and enter this code. She hovers over that link. The page behind it really is Microsoft’s.

Sarah thinks, with the clarity of the very tired: “All I wanted was to get online. Why would hotel Wi-Fi need me to repair my laptop or log in to Microsoft?” She closes the page, switches to her hotspot, waits for the VPN chime, and sends a screenshot to Marcus. His reply arrives in under a minute: a thumbs-up and “Please never delete that screenshot.”

What was actually happening

This is the most serious of the three, because there was no fake network and no attacker in the room. The hotel’s own guest-network system (or a company that runs it) had been compromised, so the name, the hardware, and the first sign-in screen were all genuine. Two tricks were at work, and both are forms of social engineering: they succeed by persuading a person, not by breaking technology.

ClickFix disguises malicious instructions as a routine repair or verification step. Instead of breaking in, the attacker asks you to do the dangerous part yourself: paste and run a command that installs malware (software designed to spy or steal). On Windows, the Windows+R shortcut opens a box that runs whatever is pasted into it, no questions asked, which is why the trick works so well. Similar traps show up as fake “browser update” pop-ups, triggered by the automatic check your laptop makes the moment it joins a network to see whether it’s online. Your laptop practically rings the doorbell itself.

Device-code phishing is subtler. (Phishing just means tricking you into handing over access.) Smart TVs and similar devices can’t show a normal login page, so Microsoft lets them display a short code that you type into the real Microsoft site on another device. Attackers start one of these sign-ins themselves, then persuade you to enter their code. You’ve just approved their session. And because you approved it, your multi-factor authentication (MFA, the extra approval step after your password, such as a prompt on your phone) is already satisfied. The lesson isn’t “Microsoft sign-in is dangerous.” It’s never enter a code for a login you didn’t start yourself.

The cost would have been steep. The malware in this campaign can capture keystrokes, screenshots, saved passwords, and sign-in tokens (digital keycards that let the holder walk into your accounts without being asked for a password again). Sarah’s keynote would have been the least of Northfield’s problems.

Who really does this: CaptiveCrunch

This is the documented playbook of a campaign Microsoft calls CaptiveCrunch. Microsoft reported (July 31, 2026, updated October 5) that a sub-group of Midnight Blizzard, also known as APT29 or Cozy Bear and attributed by the US and UK to Russia’s foreign intelligence service, has been compromising Wi-Fi sign-in pages at hotels, conference centers, and similar venues in several countries since May 2026. The goal: the accounts of corporate travelers. Put simply, travelers with company logins are the prize, and hotel Wi-Fi is how they’re being reached.

This is not just a spy-versus-diplomat story. You don’t have to be a diplomat, a politician, or a government employee to be a target. State-backed groups go after ordinary companies because company accounts hold valuable data and open doors to customers, partners, and money. One compromised employee login can be the way into the whole business. And these tricks don’t stay with spies. Criminal groups run the same playbook, ClickFix pop-ups and code-approval scams included, for financial gain: stolen funds, ransom, fraud, and resold access. They aren’t picking targets by job title. They’re targeting anyone whose login or laptop pays off, which includes everyone who travels for work at Northfield.

It is current. Microsoft saw the campaign resume on September 29. Because the attackers appear to have compromised shared guest-Wi-Fi systems rather than one hotel at a time, a correctly named hotel network can still deliver the attack. Microsoft also observed the operators using AI to help build their malware. Sarah’s encounter is a teaching example; the campaign is not.

What protects Sarah

The first layer is a refusal: she didn’t run the command, install the “fix,” or type the code. Behind that sit quieter protections that never needed her attention. Her company laptop gets updates only through Settings and IT’s tools, never a web page, so a pop-up “update” was a red flag on its own. She works from a standard (non-administrator) account, so the malware’s most powerful steps would have triggered an approval prompt she could decline. Security software adds another chance to catch a mistake, and Northfield limits device-code sign-ins to the places that truly need them, so this trick has far less to work with. Microsoft’s advice for travelers: treat hotel, conference, and airport Wi-Fi as untrustworthy, and never install anything a sign-in page offers. A phone hotspot (your phone’s own internet connection, shared with your laptop) makes that easy to follow.

Why quiet protections beat sharp eyes

Sarah caught three attacks today. That was partly skill, partly caffeine, and partly luck. Attackers design their traps to look ordinary and time them for when people are tired and rushed, and Sarah, at 9:20 p.m. after a delayed flight, was the target audience. So the safest plan can’t depend on catching everything. It depends on overlapping protections already running, so one imperfect decision doesn’t become a breach. Security people call this defense in depth, and the car version is familiar: seatbelt, airbag, and crumple zone. None of them is magic: a VPN can’t spot a fake page, and a firewall won’t stop you from typing a password into one. Together, they turned three serious attempts into three non-events.

Before your next trip: set it and forget it

1. Leave automatic updates on for your operating system, browser, and security software. Updates quietly fix the weaknesses attackers count on.

2. Keep the firewall and company security software running. A firewall is a built-in gatekeeper that blocks unwanted connections to your laptop. Never turn it, or your security software, off to make a Wi-Fi page work.

3. Set your VPN to connect automatically, with the kill switch on if available. A VPN (virtual private network) wraps your traffic in an encrypted tunnel so the network you’re on can’t read or tamper with it, and a kill switch blocks all traffic if the tunnel drops. Test it once before you leave.

4. Use your password manager everywhere and a passkey wherever offered. A password manager fills a login only on the exact right website. A passkey, stored on your phone or laptop, replaces the password and works only on the genuine site, so it can’t be handed to a fake one. If your password manager won’t fill a login, treat that as an alarm bell.

5. Turn off auto-join for public networks and turn on HTTPS-only mode in your browser, a setting that warns you before loading any page that isn’t encrypted.

6. Make your phone plan B. Know how to turn on your hotspot and give it a strong password (not “12345678”).

On the road: five refusals, no exceptions

• Never type work credentials into a Wi-Fi sign-in page. Real guest networks ask for a room number, not your employer’s password.
• Never type a password on a page marked “Not secure.” No padlock, no password.
• Never run, paste, or install anything a web page tells you to, including “repair tools” and updates. Real updates come through your computer’s settings or IT.
• Never enter a code or approve a prompt for a sign-in you didn’t start.
• Never click through a browser security warning. Read it as a polite “stop.”

The rule of thumb that covers them all: if a Wi-Fi network asks for anything unusual, disconnect and use your hotspot.

Three stops, one pattern

Look back across the trip. At the coffee shop, a convincing network name proved nothing. In the lounge, a perfect-looking page with no padlock was the warning. At the hotel, a polite request to run a fix or enter a code was the tell. Every time, the attacker’s trick was making something fake feel familiar, and every time, the defense was the same: a few quiet protections running in the background, and a habit of pausing before doing anything unusual.

If you slip anyway

People do, including the professionals. Disconnect, then tell IT or security right away, even if you’re embarrassed, even if you’re not sure anything happened, even if it’s midnight. IT can cut off stolen sessions and reset credentials within minutes if they hear early, and a false alarm costs them far less than a quiet breach. Close calls count too: a screenshot like Sarah’s lets IT warn everyone else who might stay at that hotel. Sarah’s forty-five minutes with Marcus two years ago are why she sent a screenshot tonight instead of closing the tab and hoping.

You don’t have to outmaneuver an intelligence agency while waiting for a latte. Keep the quiet protections running, say no to the few requests that would bypass them, and let your laptop do the dull, heroic work in the background. At 11 p.m. in a Denver hotel room, a little chime told Sarah her VPN was back, and she went to sleep.

That’s the end of Sarah’s story, but stay tuned for Part Eight of our Cybersecurity Awareness blog series, where we’ll dig into vishing and voice cloning.

Sources and further reading

• Microsoft Threat Intelligence: CaptiveCrunch (July 31, updated October 5, 2026)
• MITRE ATT&CK: APT29 / Midnight Blizzard (G0016)
• Microsoft: Think before you ClickFix (August 2025)
• Microsoft: Storm-2372 device code phishing (February 2025)
• Proofpoint: State-sponsored hackers embrace ClickFix
• CISA: Secure Our World

This is a security-awareness article, not an instruction set for offensive testing. Some controls depend on your organization’s devices and settings; company policy takes precedence over general travel advice.