Hackers Hijack Hotel Wi‑Fi to Push Fake Updates

How the attack worked

This campaign hijacked captive portals, the login pages that appear when a device joins a new Wi-Fi network, at hotels and conference venues. Instead of waiting for a traveler to open a browser and visit a site, the attackers answered the automated connectivity checks that operating systems and browsers send the moment a device joins a network. Those checks returned pages offering fake browser or system updates, making the lure appear at the earliest possible moment, before the victim had a chance to browse anywhere on their own.

Some of these hijacked landing pages went further, using ClickFix-style tactics: a fake "verification failed" message paired with paste-and-run instructions that asked the victim to manually copy and execute commands to "fix" their connection. Others served an Android APK directly. Later in the campaign, from July 16 onward, some pages redirected victims into Microsoft's device code authentication flow, instructing them to type an attacker-supplied code into a genuine Microsoft sign-in page to complete the corporate account takeover.

Why it succeeded

The attack exploited the routine, largely invisible moment of joining Wi-Fi. Because the fake update prompts arrived through the automatic connectivity check rather than a webpage the user chose to visit, the request felt like a normal part of getting online rather than a suspicious pop-up. The device code technique is not new, but embedding it inside a captive portal made the request feel like a legitimate step in accessing the network rather than an unusual account sign-in request.

What to watch for

• A Wi-Fi login page that asks you to install a browser or system update before you can get online
• An update or verification prompt that appears immediately upon joining the network, before you have browsed anywhere
• Any request to copy and paste commands to "fix" or "verify" your connection
• Being asked to enter a device code on a Microsoft sign-in page that you did not request yourself

Building resistance

Travelers, executives, sales staff, consultants, and anyone using hotel, conference, or airport Wi-Fi should treat these networks as untrustworthy by default. Never install software offered through a captive portal, and never enter a device code on a sign-in page unless you initiated that authentication request yourself. If a Wi-Fi login page asks for troubleshooting steps involving pasted commands, stop and report it to IT or security rather than following the instructions.

How did attackers hijack hotel Wi-Fi to install malware?

Attackers compromised captive portals on hotel and conference Wi-Fi networks and answered the automatic connectivity checks that devices send when joining a new network, returning pages that offered fake browser or operating system updates instead of a normal login page.

What is the device code sign-in trick used in this campaign?

From July 16, some captive portal pages redirected victims into Microsoft's device code authentication flow and told them to enter an attacker-supplied code on a genuine Microsoft sign-in page, which let attackers gain access to the account.

What are ClickFix-style paste-and-run prompts?

Some hijacked landing pages showed a fake verification failure message and instructed victims to copy and paste commands to fix their connection, a technique known as ClickFix that tricks users into running malicious commands themselves.

How can travelers protect themselves on hotel or conference Wi-Fi?

Treat hotel, conference, and airport wireless networks as untrustworthy, never install software offered through a captive portal, and never enter a device code on a Microsoft sign-in page that you did not initiate yourself.