- No padlock, no password. If the browser says “Not secure” or the address starts with http://, stop. A perfect-looking page isn’t proof.
- Read the address, not the logo. Lookalike spellings can carry a valid padlock.
- Wait for the VPN. If it’s reconnecting, pause before logging in to anything. Turn on the kill switch if your VPN offers one.
Previously: in Part Five, Sarah Whitlock, operations manager at Northfield Logistics, spotted a fake coffee-shop network on her way to a Denver keynote. Now she’s at the airport, on the real Wi-Fi. That doesn’t mean she’s safe.
In Part Six, Sarah is in the airport lounge, on the real Wi-Fi, when someone else on that network quietly slips between her laptop and the Internet.
Sarah and her encounters are fictional composites. The attack techniques and the groups behind them are real and documented; sources are linked at the end of each part.
10:40 a.m. | The airport lounge
The layover lounge has free pastries, aggressively modern chairs, and a Wi-Fi name printed on the wall that matches exactly what her laptop shows. This one is genuine. She joins, ticks “I agree,” and the VPN chimes.
She opens Northfield’s travel portal to rebook her return flight: the real site, padlock in the address bar. Then, for about two seconds, everything stalls. A spinning tab. A VPN icon reading “Reconnecting…” The general atmosphere of a laptop clearing its throat.
She clicks Sign in. The login page looks exactly right: same logo, same colors, and the company name is spelled correctly in the address bar. She starts typing her email. Then she notices what’s missing. Where the padlock should be, the browser says "not secure." The address now begins with http://, not https://. Her password manager offers to fill in, but with a warning she has never seen before.
Sarah stops typing. The page is real. The connection isn’t. She closes the tab, waits for the VPN icon to turn green, and types the address again herself, starting with https://. The padlock is back, the password manager fills in without complaint, and her flight gets rebooked. Nothing else happens, which is exactly the point.
What was actually happening
Another “guest” in the lounge had quietly placed their laptop in the middle of everyone’s connection, an adversary-in-the-middle attack. Remember “the directions” from Part Five? On a poorly separated network, devices find each other by shouting across the room, and nobody checks ID. The attacker simply shouted “Send your traffic through me!” first. (The technical name is ARP spoofing, if you want to impress Marcus.)
Being in the middle isn’t enough on its own, because HTTPS scrambles everything. So the attacker used a trick to get rid of it: a downgrade attack (sometimes called SSL stripping). The portal’s homepage was secure, but its Sign in button pointed to an older address that didn’t insist on a secure connection. That tiny gap was all the attacker needed. When Sarah clicked, he intercepted the hop, kept a secure connection to the real website on his side, but handed Sarah an unencrypted http:// copy on hers. Every page looked authentic because it was the real site, passed along through the attacker’s hands. Anything Sarah typed would have crossed the lounge as plain, readable text: her email, her password, and the sign-in session that follows.
| Why one missing letter matters. The “s” in https stands for secure. With it, anyone watching the network sees scrambled gibberish. Without it, they can read what you send, like a postcard instead of a sealed envelope. The website’s name can be spelled perfectly and the page can look perfect; if the browser says "not secure", don’t type anything you wouldn’t write on a postcard. |
A related trick swaps the directions entirely, sending you to a lookalike address such as northfie1d.com (a number 1 instead of an L), which can even display a valid padlock. A padlock only means the conversation is private. It doesn’t mean the other party is who you think. Check the address and let a password manager or passkey check it too.
Notice the two-second flicker
The attack worked only because of that brief “Reconnecting…” moment. While the VPN tunnel is up, the person across the lounge sees nothing but a locked armored car and can’t redirect or downgrade anything. When the tunnel drops, the laptop is briefly exposed to whatever the local network says. That is why a VPN kill switch (a setting that blocks all traffic whenever the tunnel drops) is worth turning on.
Who really does this
Downgrade attacks have been publicly demonstrated since 2009, and free tools to run them are widely available, so this is not just a spy-agency trick. ARP spoofing is documented in MITRE ATT&CK as used by Iranian- and Chinese-linked espionage groups.
The “swap the directions” version is very current. In April 2026, Microsoft, the FBI, and the US Justice Department described how APT28 (the same group from Part 1) compromised older home and small-office routers and changed their DNS settings to send people to attacker-run servers, targeting Microsoft Outlook logins. Microsoft counted more than 200 organizations and 5,000 consumer devices affected before a court-authorized disruption. Different venue, same idea: lie about where a website lives.
What protects Sarah
- VPN with auto-connect and kill switch: Keeps the lounge network from seeing or altering her traffic, and blocks traffic during the gaps.
- Browser protections: Many major websites tell browsers “only ever connect to me securely” (a feature called HSTS), and most browsers offer an HTTPS-only mode that warns before loading any unencrypted page. Neither covers every site, which is why the next layers matter.
- Password manager and passkey: They check the exact address and connection before filling anything, and passkeys can’t be replayed by someone in the middle.
- Firewall and updates: Keep other lounge guests from poking at her laptop directly.
- Her own eyes: A two-second glance at the address bar before typing a password.
| Scorecard. Attacker wanted: Sarah’s password, readable in plain text. Attacker got: half an email address and a closed tab. What did the work: a VPN that reconnected quickly, a password manager that flagged the insecure page, and a person who noticed the padlock was gone. |
Stay tuned for Part Seven, the finale of Sarah’s story, when she reaches her hotel, where the Wi-Fi name is correct and the welcome page is real, but the network itself has been compromised.
Sources and further reading
MITRE ATT&CK: Adversary-in-the-Middle (T1557)
MITRE ATT&CK: ARP Cache Poisoning (T1557.002)
MDN: Strict-Transport-Security (HSTS)
Microsoft Threat Intelligence: SOHO router compromise leads to DNS hijacking (April 2026)
Krebs on Security: Russia hacked routers to steal Microsoft Office tokens
This is a security-awareness article, not an instruction set for offensive testing. Some controls depend on your organization’s devices and settings; company policy takes precedence over general travel advice.