Summary
- Criminals are gaining access to public Wi-Fi infrastructure at hotels and conference centres and altering DNS settings.
- Manipulated DNS quietly redirects users to fraudulent login pages designed to capture credentials.
- The attack is infrastructure-level, meaning individual users have little visibility into the compromise.
- Any device connecting to affected networks is potentially exposed, regardless of operating system or security posture.
- Venues hosting large professional gatherings — conferences, summits, trade events — are a particular target given the density of high-value targets.
The Attack Pattern
Criminals are compromising the Wi-Fi infrastructure of public venues — hotels, conference centres, and similar facilities — and modifying their DNS configurations. Once an attacker controls DNS resolution on a network, they can silently redirect users from legitimate destinations to pages of their choosing. In this case, the goal is credential theft: users attempting to reach familiar services are instead served convincing fake login pages.
Why Public Venues Are Attractive Targets
Public Wi-Fi at hotels and conference centres serves a concentrated population of travellers and professionals who are often working under time pressure, on unfamiliar networks, and with their guard down. Conference venues in particular are attractive because they aggregate executives, government officials, and security-conscious organisations — exactly the accounts that carry the highest downstream value for an adversary. The density of high-value targets in a single network segment is, from an attacker’s perspective, efficient.
The Infrastructure-Level Problem
What distinguishes this attack from a standard rogue access point is that the legitimate network infrastructure itself is the vector. Users are connecting to the real network — the one the venue advertises and recommends — not a lookalike. Because the compromise sits at the DNS layer of the router or gateway device, there is no obvious signal to the end user that anything is wrong. The Wi-Fi name is correct, the signal is strong, and the network appears to function normally until a credential prompt appears unexpectedly.
Credential Exposure at Scale
The nature of DNS-based redirection means an attacker does not need to target individuals. Everyone on the network who reaches a redirected domain is a potential victim. Depending on which services are spoofed, the harvested credentials could include corporate single sign-on portals, webmail, VPN gateways, or collaboration tools. A single successful compromise of a conference venue network during a major industry event could yield a substantial volume of useful credentials.
What Remains Unknown
The source material does not detail how attackers are gaining initial access to the Wi-Fi devices themselves — whether through default credentials, unpatched firmware, exposed management interfaces, or some other means. The geographic scope is described broadly as worldwide. The identity of the threat actors involved is not attributed.
Why it matters
For CISOs, this is a reminder that network trust cannot be assumed at the infrastructure level, even on a named, seemingly legitimate network. Staff travelling to conferences or staying at hotels are routine targets. If an employee’s corporate credentials are harvested via a spoofed login page on a hotel network, the blast radius extends well beyond that individual — particularly where MFA is absent or where password reuse is a factor. The threat also underscores a governance gap: organisations invest heavily in securing their own perimeter but have no visibility into the security posture of third-party networks their people use every day.
What to do now
- Require use of a corporate VPN on all public and third-party Wi-Fi networks, ensuring DNS queries are resolved through trusted infrastructure rather than the local network.
- Enforce multi-factor authentication across all externally accessible services so that stolen credentials alone are insufficient for account compromise.
- Brief travelling staff — particularly those attending conferences or staying in hotels — on the risk of unexpected login prompts appearing while on public networks, and instruct them to verify any credential request through a separate channel before entering credentials.
- Review whether corporate devices are configured to use encrypted DNS protocols (such as DNS-over-HTTPS or DNS-over-TLS) that are less susceptible to local network manipulation.
- Include public Wi-Fi risks in regular security awareness training, with specific guidance on recognising signs of DNS-based redirection such as unexpected login pages or certificate warnings.
