Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking

Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations. The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek .

The article describes how Russian state-linked APT Midnight Blizzard is compromising public Wi-Fi gateways and captive portals at hospitality and travel venues to steal Microsoft account and Microsoft 365 credentials from corporate travelers.[1][2][5] According to Microsoft and other reporting, attackers alter DNS and captive portal flows on hotel and conference Wi-Fi to deliver malware and adversary-in-the-middle credential theft, leading to unauthorized access to cloud accounts and tokens.[1][2][3][5] From a RealGround perspective, any AI systems or agents bound to these compromised Microsoft identities (e.g., Entra ID- or M365-backed AI tools) are exposed to downstream data leakage and account takeover, so organizations should harden identity, enforce phishing-resistant MFA, restrict device code flows, and avoid using untrusted public Wi-Fi for accessing AI-integrated corporate resources.[2][8][10] Continuous AI-focused red teaming and readiness assessments can help verify that AI agents fail safely when underlying identity or network infrastructure is compromised, and AI CISO advisory can align identity, Wi-Fi, and AI governance controls in response to this APT activity.[2][8][