Russian Hackers Turned Hotel Wi-Fi Into a Password Trap — Since June, in 3 Countries
Russian Hackers Turned Hotel Wi-Fi Into a Password Trap — Since June, in 3 Countriesyou check in, you connect to the lobby wifi, you log into your work email… and a ghost in the router copies your password. no warning. address bar looks perfect.
Active since June 2026 · fake Microsoft login sites like m365-owa.com · a spyware bug named “CornFlake” · victims across US cities, India & Saudi Arabia
Microsoft literally put out a hotel-wifi warning on Aug 1. Full breakdown from BleepingComputer and the ReliaQuest research that caught it.
so basically the free wifi you trust the most — hotels, conference halls, that fancy coworking lobby — got turned into a pickpocket. and the wildest part? you’d never see it happen. no cap, this is the scariest kind of hack: the one where everything looks normal.
🧩 Dumb Mode Dictionary
| Scary Word | What It Actually Means |
|---|---|
| DNS | The internet’s phone book. You type “email.com,” DNS tells your phone the real address to go to. Poison the phone book, send people anywhere. |
| Gateway/Router | The box that hands out wifi. Whoever controls it controls where everyone’s traffic goes. |
| Session token | A backstage pass your browser keeps so you don’t retype your password. Steal the pass, skip the password AND the 2-step code entirely. |
| RAT | Remote Access Trojan. Spyware that lets a stranger watch your screen, read your keys, grab your files. This one’s nicknamed “CornFlake.” |
| WPAD | A lazy Windows feature that auto-asks the network “hey, any proxy I should use?” Attackers just… answer yes. |
| APT28 | A Russian government-linked hacking crew. State-sponsored, patient, professional. Not some kid in a basement. |
🕰️ How we got here
Security firm ReliaQuest noticed something weird starting June 2026: business travelers getting their Microsoft 365 work accounts hijacked, but nobody clicked a dodgy email.
The trick? Attackers quietly took over the wifi gateway boxes at hotels and shared venues. That box does DNS for every guest. So when you type your normal Outlook web address, the poisoned box secretly sends you to a look-alike fake — m365-owa.com, owa-ms365.com, ms365-device.com, ms365-live.com — that looks exactly like the Microsoft login. You type your password. They keep it. You get logged in for real, so you never notice.
The address bar looked 100% correct. That’s what makes DNS poisoning nasty — the URL is right, the page is wrong.
🛠️ What the hack actually does (the 3 combos)
- Fake login harvest → clones Microsoft 365 sign-in pages, steals passwords AND the session token (so your 2-step code doesn’t save you).
- Fake “software update” popups → the hijacked wifi shoves a “please update” box at you. Click it, you install CornFlake — spyware that logs keys, screenshots your screen, and steals files. (The Hacker News writeup)
- The WPAD trick → abuses a Windows auto-setting so your PC routes traffic through their server without you doing anything. (Microsoft’s own explainer on WPAD if you’re nerdy.)
📊 The receipts
| Detail | Number |
|---|---|
| Active since | June 2026 |
| Countries hit | US, India, Saudi Arabia |
| Industries targeted | Finance, law, healthcare, energy, retail |
| Fake domains spotted | m365-owa.com, owa-ms365.com, ms365-device.com, ms365-live.com |
| Spyware name | CornFlake (RAT) |
| Suspected crew | FrostArmada / APT28 (Russia-linked) |
| Same trick used earlier | Home routers, earlier in 2026 |
🗣️ What the timeline's saying
- IT admins: “great, now every business trip is a security incident waiting to happen.”
- Forbes ran a straight-up warning telling Windows users to treat hotel wifi as hostile.
- The reformed-paranoid crowd: “this is why i’ve used a travel router + VPN since 2019, laugh at me now.”
- Everyone else: slowly realizing “free wifi” was never free — you were just paying in trust.
Cool. A Ghost Lives in the Lobby Router… Now What the Hell Do We Do? (⊙_⊙)
here’s the thing — every time the big companies get scared, a gap opens up. millions of travelers just found out their #1 habit is dangerous, and they have NO idea what to do about it. that panic? that’s a door. these plays ride the exact fear this news created. move while it’s hot.
📡 The Rogue-Router Snitch
Venues have NO way to know their own wifi box got poisoned. You build a dead-simple check: connect to a venue’s wifi, run a free DNS-tamper test, and hand the manager a one-page “clean / compromised” report. Boutique hotels and coworking spots will pay to prove they’re safe — because one breach story kills their bookings.
The whole test is basically comparing what their wifi says vs. what a trusted DNS (Cloudflare’s 1.1.1.1 or Google’s 8.8.8.8) says. If they don’t match, something’s rotten.
Example: A 24-year-old IT student in Lahore, Pakistan walks into 15 local co-working spaces, runs a free dnschecker.org comparison + a Wireshark DNS capture, and offers a monthly “Wi-Fi Safe Seal” sticker for the lobby for $40/venue/month. Signs 9 of them = $360/month recurring for a 20-minute visit each.
Timeline: First paying venue in ~1 week (fear sells fast). Plateau in 3-4 months once you’ve hit every local spot — then franchise the checklist to a buddy in the next city.
🧳 The Road-Warrior Safety Kit
Everyone hyped about the danger; nobody wants to learn networking. So sell the boring shovel: a pre-configured travel router that makes ANY hotel wifi safe. You plug their box in, it hides behind your device, VPN baked in, DNS locked. Traveler just connects to YOUR mini-router, never the dirty one.
You buy a GL.iNet travel router (~$30-60), pre-load it with a VPN + locked DNS, print a 3-step card, and resell the setup — not the hardware, the peace of mind.
Example: A 29-year-old gadget reseller in Manila, Philippines bundles a GL.iNet Beryl + a year of a cheap VPN + a laminated “how to stay safe” card, sells the kit to traveling sales reps and consultants on local marketplaces for a clean markup. Moves 40 kits in a month riding the news headline.
🎣 The Fake-Portal Fire Drill
Companies are freaking out that their traveling staff will fall for fake login pages. You build a harmless clone of a hotel wifi login screen and offer to “test” a company’s road warriors — send it to their traveling employees, see who types their password, hand HR a report on who needs training.
It’s the same idea as a fire drill: you’re not the arsonist, you’re the guy who proves the smoke alarms work. Use a legit phishing-simulation tool like GoPhish (free, open-source) so it’s all above board and logged.
Example: A 26-year-old freelancer in Nairobi, Kenya runs a one-time “travel phishing drill” for a 30-person law firm using GoPhish, delivers a clean PDF of results + a 1-page fix sheet, charges a flat $500 per drill. Two firms a month = solid side income.
📖 The Niche Dictionary Play
When scary news drops, a NEW vocabulary appears overnight — “DNS poisoning,” “CornFlake,” “captive portal,” “session hijack” — and millions Google it, panicked, at 11pm. Be the first clean, dead-simple cheat sheet that explains it AND tells them exactly what to do. First comprehensive guide = the search-engine anchor everyone links to.
You’re not selling anything at first — you’re building the page every worried traveler lands on. Then you slot in the travel-router kit and the safety checklist as your “recommended tools.”
Example: A 22-year-old writer in Jakarta, Indonesia publishes “Is Hotel Wi-Fi Safe? The 2026 Traveler’s Survival Guide” — plain English, screenshots of the fake domains, a printable checklist — on a free Notion page + Medium. Ranks for “hotel wifi safe” in weeks, then earns from affiliate links to VPNs and travel routers.
🪟 The Patch-Window Sprint
Right now there’s a gap: Microsoft warned people, but 99% of hotels have NOT checked or updated their gateway boxes. That’s a 2-4 week window where you can be the “we already fixed it” hero to small hotel owners before the big security firms even send a sales email.
Approach independent hotels (not chains — chains are slow) and offer a one-time “gateway hardening” — update firmware, lock DNS to a trusted resolver, kill the WPAD trick. In-and-out, flat fee, they sleep better.
Example: A 31-year-old freelance network tech in Cairo, Egypt DMs 25 boutique hotels the day the Forbes warning drops, offers a $200 “traveler-safe wifi audit + lockdown,” closes 6 in the first two weeks = $1,200 while the fear is fresh.
🛠️ Follow-Up Actions
| Move | First Step Tomorrow |
|---|---|
| Router Snitch |
Learn the dnschecker.org vs local-wifi comparison, test your own home wifi first |
 Safety Kit |
Price a GL.iNet travel router + a cheap VPN, build one demo kit |
 Fire Drill |
Spin up free GoPhish, run a test drill on your own inbox |
 Dictionary |
Draft the guide on Notion, grab screenshots of the fake domains from the news |
 Patch Sprint |
Read up on locking a router’s DNS + disabling WPAD, then DM 5 local hotels |
Quick Hits
| If You Want To… | Do This |
|---|---|
 Never get caught by this |
Turn on a VPN BEFORE connecting to any public wifi — encrypts everything, DNS poison can’t touch you |
 Kill password theft dead |
Use passkeys / hardware keys — nothing to type = nothing to steal |
 Ignore fake “update now” popups |
Only update software from the official app itself, NEVER from a wifi popup |
 Skip hotel wifi entirely |
Tether to your phone’s hotspot — your own data is way safer than the lobby box |
 Check if you’re already hit |
Look at aka.ms/365signins for weird logins from cities you didn’t visit |
the free wifi was never free. you were paying in trust — and someone just figured out how to cash it out.
!