TP-Link Omada Chain Steals Admin Logins via Fake Pop-Up

Help Net Security · High sophistication
Last updated August 5, 2026

Researchers demonstrated an attack chain against TP-Link Omada where attackers can claim a device in the cloud using guessed serial numbers and default factory credentials. The attacker can then inject a fake “session expired” login prompt into the admin’s browser to steal the cloud controller password and potentially create a VPN tunnel into the victim’s internal network. The issues affect Omada and also extend to other TP-Link product families that share the same certificate trust chain.

Key findings

  • Sequential device serial numbers can be guessed and queried to retrieve matching device details from the cloud service.
  • Attackers can race device adoption by spoofing a MAC address and using factory credentials (admin/admin) to complete the authentication challenge.
  • The cloud can return site credentials (including a site username in cleartext and a site password as an unsalted MD5 hash), and the protocol may accept the hash as proof of identity.
  • A firmware version field is not sanitized; JavaScript placed there can execute in the administrator’s browser and be used to display a fake login box to steal credentials.
  • Once in the controller account, attackers can configure VPN tunnels into the internal network; the article also cites a root command execution flaw (CVE-2025-7850) on devices once inside.
  • Omada controllers ship with a baked-in TLS certificate/private key; if extracted, attackers can impersonate a controller, and similar trust issues affect VIGI, Festa, Tapo, and Kasa product families.

Who’s being targeted

  • Commonly targeted roles: IT, Network administrators, Security operations, Facilities / Physical security (camera admins).
  • Affected industries: Small and medium businesses (SMBs) using TP-Link Omada, IT / Network operations teams, Physical security / camera deployments (VIGI), Consumer / smart home deployments (Tapo, Kasa).
  • Attack channels: website.
  • Impersonated: Omada dashboard / cloud controller login.

Awareness takeaways

  • Treat unexpected re-login prompts inside admin consoles as suspicious; verify by navigating to the known login page rather than typing credentials into pop-ups/overlays.
  • Do not rely on shared passwords across many devices; use unique credentials and rotate them after provisioning.
  • Turn on multi-factor authentication (MFA) for cloud management accounts to reduce the impact of stolen passwords.
  • Prioritize patching controllers and management apps first, since compromise of the controller can expose all managed devices.

Red flags to watch for

  • Unexpected “session expired” box appearing as an overlay inside the admin console
  • Login prompt that does not behave like the normal sign-in flow (embedded over the dashboard)
  • Any re-login prompt that appears immediately after device/provisioning activity or at unusual times
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

You’re in the TP‑Link Omada dashboard, configuring a site, when a “session expired” login box suddenly pops up over the screen. Researchers showed they can claim Omada devices in the cloud, inject JavaScript into a firmware field, and use it to draw this fake session-expired box that sends your password to their server. Here’s the trick: the fake box looks legit and sits right on top of your live dashboard. But Omada normally logs you out with a full-page redirect to the real login screen, not a little pop-up floating over active graphs and devices. If Omada asks you to log in again, don’t trust the pop-up. Close it, go to your normal Omada login URL in a fresh tab, and sign in only there.

Similar attacks

DocuSign Share Lure Steals Microsoft 365 Sessions

DocuSign Share Lure Steals Microsoft 365 Sessions

Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…

August 28, 2026
Fake Recruiters Steal Enterprise Logins on Mobile

Fake Recruiters Steal Enterprise Logins on Mobile

A real “fake recruiter” phishing campaign (tracked as RecruitTrap) is targeting employees’ corporate credentials, especially on mobile devices. The scam uses lookalike recruitment domains and full-screen fake login pages that hide browser cues, and it rejects personal email addresses to focus on…

August 25, 2026
ReliaQuest Employee Tricked Into Okta SSO Login

ReliaQuest Employee Tricked Into Okta SSO Login

ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…

August 25, 2026
ShinyHunters Impersonation Call Tricked ReliaQuest MFA

ShinyHunters Impersonation Call Tricked ReliaQuest MFA

ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…

August 25, 2026
ShinyHunters Hit ReliaQuest With SSO Phish + Calls

ShinyHunters Hit ReliaQuest With SSO Phish + Calls

ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…

August 24, 2026
Recruitment Emails Hide BitB Google/Facebook Traps

Recruitment Emails Hide BitB Google/Facebook Traps

Researchers found a large recruitment-themed phishing campaign where victims receive unsolicited interview invites and are sent to fake scheduling or recruitment pages. The pages use “Browser-in-the-Browser” fake login popups to steal Google/Facebook passwords and, in some cases, capture MFA codes…

August 17, 2026