Microsoft has confirmed a widespread Russian hacking campaign targeting hotel Wi-Fi networks is stealing Microsoft 365 credentials and delivering malware to Windows PCs.