Captive Portal Trick Hits Travelers With Fake Updates

How the Attack Worked

This campaign targets travelers connecting to Wi-Fi at hotels, conference centers, and other shared venues. Rather than relying on email, the attackers manipulate DNS and HTTP traffic served through captive portals, the login pages that appear when joining public Wi-Fi. This redirects victims through actor-controlled infrastructure before they ever reach a legitimate website.

From that position, the attackers ran two main plays. First, victims were shown fake browser or operating system update prompts, sometimes tied to automated connectivity checks. Some of these used ClickFix-style techniques, prompting users to manually run scripts or commands to "repair" their connection, which instead installed malware. Android users were sometimes told to download and install an APK file directly from the captive portal page.

Second, the attackers used adversary-in-the-middle phishing with doppelganger domains that closely mimic Microsoft's online services. These pages abused the device code and OAuth authentication flows in Microsoft Entra ID, tricking users into approving what looked like a normal sign-in but actually let the attacker register a device and access Microsoft 365 data.

Why It Succeeded

The attack succeeds because it exploits a moment when users have low suspicion: connecting to Wi-Fi in an unfamiliar location and just wanting to get online. Captive portals and connectivity checks are a normal part of using public networks, so a prompt to "update" or "verify" blends into an expected experience. The use of device code authentication is especially effective because many users are unfamiliar with what a legitimate device code flow looks like, making it hard to distinguish from a real Microsoft prompt.

What to Watch For

• Any prompt to install an update or app immediately after joining public Wi-Fi, rather than through your device's normal update mechanism
• Instructions asking you to manually run scripts or commands to fix connectivity
• Sign-in pages reached only after a Wi-Fi redirect, especially ones using device code prompts you did not initiate
• Domains that look like Microsoft but are subtly altered
• Any site instructing Android users to install an APK outside the official app store

How to Build Resistance

• Treat captive portal popups as untrusted; never install updates or run commands to get online
• Verify domains carefully before entering credentials, especially after joining unfamiliar networks
• Avoid approving device code or OAuth prompts unless you explicitly initiated a device setup
• Use a cellular hotspot or VPN when possible instead of relying on venue Wi-Fi
• Report suspicious prompts quickly, since stolen session tokens and cookies can grant access even without a password

What is a captive portal Wi-Fi attack?

Attackers manipulate DNS and HTTP traffic on hospitality networks served by captive portals to redirect travelers through actor-controlled infrastructure, where they are shown fake update prompts or phishing sign-in pages.

How does the fake update trick work?

After joining venue Wi-Fi, users see a prompt saying their browser or operating system needs an update to continue connecting. Following the instructions, which sometimes involve running commands via ClickFix techniques, installs malware instead.

Why is the Microsoft sign-in phishing dangerous?

The campaign uses lookalike doppelganger domains that mimic Microsoft online services and abuses the device code authentication flow in Microsoft Entra ID, allowing attackers to register devices and access Microsoft 365 data without needing the user's password directly.

Who is most at risk from this campaign?

Corporate travelers are the primary target, including executives, sales and field staff, finance, and IT administrators who connect to hotel or conference center Wi-Fi while working remotely.