- Check the network name against a sign, card, or staff member. Stronger signal doesn’t mean real.
- Turn off auto-join for public networks and forget the ones you no longer use.
- If your password manager won’t fill a login, stop. It is checking the address for you, and it doesn’t get tired.
In Part Four of our Cybersecurity Awareness blog series, we discussed how stolen personal data is bought and sold and the simple habits that make it worth less to criminals. In Part Five, we begin a three-part story following a business traveler through a day of public Wi-Fi and the tricks attackers use to steal her login.
Sarah and her encounters are fictional composites. The attack techniques and the groups behind them are real and documented; sources are linked at the end of each part.
Meet Sarah (and her laptop)
Sarah Whitlock is a regional operations manager at Northfield Logistics, a mid-sized freight company. She once rerouted thirty trucks around a blizzard from the passenger seat of a minivan, and she has strong opinions about airport coffee.
Two years ago, a text about a “missed delivery” (an irony not lost on a logistics professional) led her to click a link she shouldn’t have. Forty-five humbling minutes on the phone with Marcus from the IT help desk caught the problem before anything was lost. Since then she reads the tips at the bottom of IT’s emails, and she reaches for her phone before she reaches for her password.
Today she is flying to Denver to give a keynote at 8 a.m. tomorrow. Her laptop holds the slides, the quarterly numbers, and signed-in access to company email and files. It is set up exactly the way Marcus insisted: automatic updates, a firewall, company security software, a password manager, a passkey, and a VPN that connects on its own and announces it with a cheerful chime she has complained about more than once.
Why target Sarah? Not because she is a spy or a diplomat. A business traveler is a convenient door: a laptop signed in to valuable accounts, on networks she doesn’t control, held by a tired person with a deadline. Attackers don’t need Sarah to be important. They only need her login to be.
Wi-Fi in 60 seconds
Joining Wi-Fi feels like magic, but it is really a quick series of moments where your laptop decides to trust something. Attackers love those moments. Here are the four that matter in this series:
1. The name tag. Every network broadcasts a name (the SSID), like “Hotel_Guest.” Anyone can print a name tag, and your laptop may automatically call out for networks it remembers.
2. The welcome page. Many public networks show a sign-in page (a captive portal) before you get online. A room number or an “I agree” box is normal. A request for your work password, a download, or a command to paste is not.
3. The directions. The network tells your laptop where to send traffic and how to look up websites (a phone-book service called DNS). Your laptop believes whatever it is told. Nobody asks for ID.
4. The padlock and the tunnel. HTTPS (the padlock, and the “s” in https://) scrambles your conversation with a website and confirms the site owns the address shown. A VPN wraps all your traffic in an encrypted tunnel back to the company, like an armored car through a questionable neighborhood.
Each protection covers a different stretch of the trip. None covers all of it. Today’s attack goes after the name tag; Part Six goes after the directions and the padlock; Part Seven goes after the welcome page.
| Who is behind this? Some attacks in this series come from ordinary criminals. Others come from APTs (Advanced Persistent Threats): well-funded, often government-backed hacking groups that run patient, long-term operations. Security companies each give these groups their own names, so one Russian group might be “APT28,” “Fancy Bear,” or “Forest Blizzard” depending on who is talking. Defenders track their known methods in MITRE ATT&CK, a free public catalog of real-world attacker behavior. |
7:15 a.m. | The coffee shop
Sarah is in line at DailyBrew, the café near the airport with the excellent oat-milk latte and a barista who calls everyone “boss.” She has forty minutes before boarding and an email from the CFO that begins “Quick question,” which has never once been quick.
Two networks top the list: “DailyBrew-FreeWiFi” and “DailyBrew_Guest.” The second has a stronger signal, so obviously that’s the good one. It connects instantly, no password. A polished welcome page loads, logo and all: “Claim your free Wi-Fi! Sign in with your work email.”
Sarah’s eyebrow lifts. Her password manager, which normally leaps at login boxes like a golden retriever at a tennis ball, sits perfectly still. Her VPN shows “Waiting for network sign-in.” She glances at the chalkboard by the register: “DailyBrew-FreeWiFi.” Hyphen, not underscore. The friendly network she joined is not the café’s.
She says, quietly, “Nope.” She forgets the network, turns on her phone’s hotspot, and three seconds later the VPN chimes. The latte arrives. Total damage: none.
What was actually happening
Someone nearby was running an Evil Twin: a fake network wearing a real one’s name tag, controlled by an attacker. Copying a network name takes seconds, and a fake can be made “louder” than the real one, which is why the stronger signal pulled her in. Attackers can even listen for laptops calling out remembered network names and simply answer, “Yes, that’s me!” (This is why forgetting old networks matters.) Some will also send forged “you’ve been disconnected” signals to knock you off the real network and nudge you toward theirs.
Controlling the Wi-Fi does not let an attacker read properly encrypted HTTPS traffic. So they don’t try. They ask nicely instead, with a convincing fake page. It is the oldest trick in the book, phishing, with better lighting.
Who really does this
MITRE ATT&CK documents APT28, attributed to Russian military intelligence, using a portable Wi-Fi testing gadget to set up Evil Twin networks to capture passwords and plant spyware. And you don’t need to be a nation-state: in 2024, Australian police charged a man over alleged fake Wi-Fi networks on flights and in airports that harvested travelers’ logins.
What if she had typed her password anyway?
Sarah isn’t perfect, so let’s run the tape forward. The attacker would hold a password that is close to useless on its own, because her company requires a second proof of identity. Her passkey only works on the real company website and cannot be handed to a lookalike. Her phone would buzz with a sign-in request she didn’t start, and she would deny it. One caution: some attackers relay codes and approvals in real time, so “approve” on an unexpected prompt is never the right answer.
| Scorecard. Attacker wanted: Sarah’s work password. Attacker got: a very short connection. What did the work: a laptop that doesn’t auto-join unknown networks, a password manager that refused to fill a fake page, a VPN that waited instead of guessing, a passkey as backup, and a person who looked up at a chalkboard. |
Next in Part Six: Sarah is on the airport’s real Wi-Fi, on a real website, and the padlock quietly disappears.
Sources and further reading:
MITRE ATT&CK: Evil Twin (T1557.004)
ABC News: Alleged Evil Twin Wi-Fi network creator charged (2024)
Microsoft Support: Protect your accounts with passkeys
FTC: Are Public Wi-Fi Networks Safe?
This is a security-awareness article, not an instruction set for offensive testing. Some controls depend on your organization’s devices and settings; company policy takes precedence over general travel advice.