That free Wi-Fi can cost you everything

One Hotel Login Can Cost You Everything

Business travelers connect to hotel Wi-Fi every day without a second thought. Unfortunately, cybercriminals know it.

Microsoft has issued a warning about an active campaign by a Russian state-sponsored threat group that is compromising hotel and hospitality Wi-Fi networks to steal credentials, install malware, and gain long-term access to victims’ devices. The attacks have reportedly been observed across hotels, conference centers, and other hospitality venues worldwide.

This isn’t just another phishing email. It’s an attack that begins the moment you connect to what appears to be a legitimate hotel network.

How the Attack Works

Many hotels use a captive portal—the webpage that appears before you can access the internet.

Attackers are compromising these portals and presenting convincing fake prompts that appear to be legitimate Windows or browser updates. Victims believe they are fixing a connectivity issue or completing a required update, but instead they are installing malware.

Once installed, the malware can:

• Steal saved passwords

• Capture browser cookies

• Access confidential documents

• Record keystrokes

• Take screenshots

• Capture audio and video

• Monitor clipboard contents

• Give attackers remote control of the computer

Even more concerning, some victims are redirected to fake Microsoft 365 login pages, allowing attackers to steal email credentials and gain access to OneDrive, SharePoint, Teams, and other Microsoft services.

For businesses that rely on Microsoft 365, one compromised employee can become the entry point for a much larger attack.

Why Small Businesses Should Care

Cybercriminals don’t have to breach your firewall anymore.

Sometimes they simply wait until your employees leave the office.

Sales representatives, executives, attorneys, healthcare professionals, consultants, and remote workers frequently connect from hotels while traveling. One successful compromise can expose:

• Customer information

• Legal documents

• Medical records

• Financial data

• Internal communications

• Cloud storage

A single infected laptop can bypass months of cybersecurity investments when it reconnects to the corporate network.

Red Flags Every Traveler Should Recognize

If you’re connected to hotel Wi-Fi and suddenly see prompts asking you to install software before browsing, stop immediately.

Be suspicious of unexpected requests to install:

• Windows Updates

• Browser updates

• Security scans

• PDF viewers

• Network repair tools

• Certificates

• Microsoft Visual C++ packages

• Runtime installers

Legitimate hotel Wi-Fi almost never requires software installation simply to access the internet.

How to Protect Yourself

Simple precautions dramatically reduce your risk:

• Use your phone’s hotspot whenever possible instead of public Wi-Fi.

• Never install software or updates from a hotel login page.

• Verify Microsoft 365 login pages before entering credentials.

• Enable Multi-Factor Authentication (MFA) on every business account.

• Keep devices updated before traveling—not after connecting to public Wi-Fi.

• Use Endpoint Detection and Response (EDR) to identify suspicious behavior.

• Train employees to recognize captive portal scams before they travel.

• Consider using a trusted VPN, understanding that it protects traffic after a secure connection is established but cannot stop you from voluntarily entering credentials into a fake login page or installing malicious software.

The Bigger Picture

This campaign is a reminder that modern cyberattacks aren’t always launched through sophisticated exploits—they often succeed because attackers exploit trust.

When a fake login page appears on what seems to be a legitimate hotel network, many people assume it’s safe.

That’s exactly what these attackers are counting on.

Businesses must assume employees will work from airports, hotels, and conference centers. Security strategies need to protect users wherever they connect—not just inside the office.

70% of all cyber attacks target small businesses, I can help protect yours.

#CyberSecurity #ManagedIT #Microsoft365 #BusinessSecurity #SmallBusiness