I’m writing this from a hotel room in Las Vegas while attending Black Hat and DEF CON.
Thousands of security professionals from around the world are gathered here to discuss the latest vulnerabilities, zero-day exploits, AI security, ransomware, identity protection, and the future of cybersecurity. Ironically, one of the most interesting security stories this week isn’t taking place inside the conference halls.
It’s happening on hotel Wi-Fi.
Microsoft and ReliaQuest recently disclosed an operation in which attackers compromised hotel captive portal infrastructure and used it to redirect guests to convincing fake browser and operating system update pages. Rather than exploiting a vulnerability in Windows or the browser itself, the attackers relied on something much more predictable:
They convinced users to compromise themselves.
For years, we’ve focused on patching software, reducing vulnerabilities, deploying endpoint protection, and strengthening identity controls. Those investments remain essential, but this campaign demonstrates that attackers are increasingly bypassing technology altogether in favor of exploiting human trust. In this example…
- The browser wasn’t broken.
- Windows wasn’t broken.
- The firewall wasn’t bypassed.
The user simply believed the prompt…
The Trust Attack Surface
One of the screenshots Microsoft shared is remarkably simple. A fake Google verification page instructs the user to…
- Press Win + X
- Open Terminal
- Paste a command from the clipboard
- Press Enter
- Approve the UAC prompt
To many users, those instructions appear legitimate. After all, they’re trying to connect to hotel Wi-Fi. They’ve encountered captive portals before. They’ve seen browser verification pages. Nothing about the experience immediately screams “nation-state malware.”
But in reality, the victim has just executed attacker-supplied code.
This technique, often referred to as ClickFix, has become increasingly popular because it turns the victim into an active participant in the compromise. The attacker no longer needs to defeat exploit mitigations or bypass modern browser protections. They simply need to provide believable instructions.
It’s True… Hotel Wi-Fi Was Never the Real Problem
For years, security advice about public Wi-Fi focused on encryption. Things such as…
- Don’t use open networks.
- Use HTTPS.
- Use a VPN.
Those recommendations are still valid, but this campaign highlights a different issue. The risk isn’t necessarily the wireless network itself. It’s the infrastructure controlling your first interaction with the internet.
If an attacker controls, or has compromised, the captive portal or supporting DNS infrastructure, they influence what you see before you’ve established trust. That creates opportunities for convincing social engineering rather than traditional exploitation.
The initial foothold isn’t gained through a software vulnerability. It’s gained through credibility.
Spoiler Alert… This Isn’t Just About Hotels
While the current reporting centers on hospitality networks, the underlying lesson applies much more broadly. Any environment that presents users with login pages, software updates, certificate warnings, or troubleshooting prompts becomes an opportunity for attackers to impersonate legitimate workflows. Some examples are…
- Coffee shops.
- Airports.
- Conference venues.
- Guest wireless networks.
- Corporate onboarding portals.
Anywhere users expect “one more step” before gaining access becomes fertile ground for social engineering.
Another Example of How Identity Is Now the Primary Target
One aspect of Microsoft’s report deserves particular attention. The campaign doesn’t stop at installing malware. In some cases, victims are redirected into Microsoft’s legitimate device code authentication flow. If they enter an attacker-provided device code, they may unknowingly authorize the attacker’s session using their own multi-factor authentication.
I believe this represents a significant shift. The objective isn’t necessarily persistence on the endpoint. The objective is hijacked identity. If attackers obtain valid Microsoft 365 or Entra ID tokens, they may no longer care about the compromised laptop. Access to cloud identities, mailboxes, SharePoint, and OneDrive can provide everything they need. Increasingly, we’re protecting devices while attackers pursue sessions.
Consider This…
Rather than responding with fear, I believe that organizations should revisit their assumptions about business travel and remote access. A few practical considerations include…
- Encourage full-tunnel VPN usage when traveling so DNS requests and traffic are protected as early as possible.
- Train employees that software updates should originate from the operating system or browser, not from captive portals.
- Educate users that no legitimate website should instruct them to open PowerShell, Command Prompt, Terminal, or Run and paste commands.
- Review Conditional Access policies to determine whether device code authentication is required for your environment and restrict it where appropriate.
- Continue investing in identity monitoring alongside endpoint detection.
Protective technology remains critical, but user education has never been more important.
Security Is Becoming a Psychology Problem
Perhaps my biggest takeaway from this campaign is that cybersecurity is becoming less about exploiting software and more about exploiting expectations.
- Attackers understand how users behave.
- They know travelers expect captive portals.
- They know users click through browser warnings.
- They know people trust familiar logos.
- They know many employees have been conditioned to “just get connected” before the next meeting.
That’s not a technical weakness, it’s a human one.
So as I sit here in Las Vegas surrounded by thousands of cybersecurity professionals, it’s hard not to appreciate the irony.
We’re attending some of the world’s most advanced security conferences while connecting to the same types of hotel networks that have become attractive targets for sophisticated threat actors.
The lesson here isn’t that every hotel network is compromised, or that public Wi-Fi should be avoided entirely. It’s that we need to retire the notion of a “trusted network.” Trust should no longer be based on where we connect. It should be based on how we verify, authenticate, and validate every interaction… especially the ones that appear routine. Because in modern cybersecurity, the most dangerous prompt isn’t always a malware alert. Sometimes it’s simply a webpage asking you to press Win + X.
