|
Microsoft Investigation Reveals Hotel Wireless Attacks
Microsoft says a Russian hacking group has been targeting travelers by tampering with Wi-Fi systems at hotels and conference centers. When people connect to these guest networks, the attackers can send them to fake Microsoft 365 sign-in pages or fake software update screens. As with many phishing attacks, the goal is to trick users into entering their login information or installing malicious software without realizing it.
If the malware is installed, it can quietly collect sensitive information such as passwords, browser cookies, login tokens, screenshots, files, and even microphone or webcam activity. Microsoft reports that the attackers they investigated used several tools to keep access to infected devices and manage stolen data. In simple terms, this campaign turns public Wi-Fi into a trap that can capture work accounts and private information.
While the report itself is from Microsoft, this same type of attack could be used to gain access to other details in addition to 365 accounts and could theoretically be used to gain access to data even without a connection to 365. Additionally, while the report is about hotel Wi-Fi, it could be applicable to similar free wireless networks at other locations - it just may not be as frequent at other locations as of yet.
Microsoft recommends treating hotel and conference Wi-Fi as unsafe for business use whenever possible. Instead, it’s recommended to use cellular data, a trusted hotspot, or a managed company connection instead of public guest Wi-Fi. Additionally, avoid installing updates offered through Wi-Fi login pages in general and use stronger sign-in protections such as MFA, passkeys, and phishing-resistant authentication for any online accounts.
If you would like to discuss safer methods for connecting to organizational accounts when on the go, please feel free to contact our offices so that we can discuss what options might best suit you.
| 
