Foreclosurepedia has covered fraud dressed up as convenience before. This one hides in the router down the hall.
Cybersecurity firm ReliaQuest disclosed in late July that hackers have been quietly compromising Wi-Fi gateways and captive portals at hotels and conference centers since at least June 2026. Microsoft confirmed the scope on August 1, attributing a related global campaign — dubbed CaptiveCrunch — to Storm-2945, a sub-cluster of the Russian state-linked group Midnight Blizzard, active since early May.
How the Trap Works
No phishing email arrives. No attachment gets opened. The victim does everything right and still loses the account.
Attackers break into the management interface of a hotel or conference Wi-Fi gateway, often through weak or default administrative passwords or unpatched firmware. Once inside, they alter the DNS settings for every guest connected to that device — not one laptop, one whole venue. A traveling FST checking email before a client meeting types in the same Microsoft 365 address he always does. The gateway quietly answers with a hacker-controlled address instead of the real one.
The fake login page uses domain names built to look like Microsoft’s own. A tech moving fast between appointments, one eye on the clock, is exactly who these pages are built to catch. Some versions go further, presenting a device-code authorization prompt that looks like routine sign-in. Approve it, and the hacker has already opened a live session — collecting a valid access token that survives even when multi-factor authentication is turned on.
Researchers traced compromised gateways across multiple U.S. cities plus India and Saudi Arabia. Victim traffic spanned financial services, legal, health care, energy, retail, and professional services — the campaign is not chasing an industry, it is chasing anyone who travels for work and opens a laptop.
Why This Belongs in the Field Services Conversation
Field inspectors and property preservation techs travel constantly — regional trainings, NAMFS-adjacent conferences, client meetings in hotel conference rooms rented by the very firms that employ them. That travel pattern is precisely the attack surface this campaign is built for.
A compromised FST credential is not a private inconvenience. It is a door into scheduling systems, client portals, work order platforms, and whatever cloud storage holds inspection photos, addresses, and homeowner data. One stolen login in a mortgage field services operation touches every file behind it.
What Management Must Do — Not Suggest, Do
Mandate a full-tunnel, always-on VPN for any device that touches company systems while traveling. A VPN a tech has to remember to switch on leaves a gap the attacker only needs for seconds.
Block device-code authentication flow in Conditional Access policies unless a specific business case requires it. This single setting closes the MFA-bypass path researchers flagged as the most dangerous part of the campaign.
Stop treating travel security as an afterthought. If a firm sends techs to conferences and trainings without a hardened connection policy, that firm is choosing the exposure.
What Labor Must Do — For Yourself
Treat hotel and conference Wi-Fi as hostile territory, full stop. A cellular hotspot beats “free Wi-Fi” every time cost isn’t the deciding factor. Never install an “update,” certificate, or “security tool” a captive portal pushes at you before granting internet access.
Never enter your company Microsoft 365 credentials on a hotel registration page or anything that doesn’t look exactly right — down to the domain in the address bar.
If a Microsoft sign-in prompt appears asking you to approve a code you didn’t request, decline it and report it immediately.
The Bottom Line
Foreclosurepedia has documented plenty of ways this industry gets exploited from inside — misclassification, kickbacks, unpaid invoices. This one comes from outside the industry entirely, and it doesn’t care whether the target is a $12-an-hour inspector or a regional VP. It only cares whether the laptop connected to the wrong router.
Management that skips the VPN mandate is gambling with client data. Labor that skips the skepticism is gambling with their own name. Neither bet is worth taking.
Foreclosurepedia will continue monitoring this campaign and any fallout affecting mortgage field services personnel.
