# Russian Hackers Turned Hotel Wi-Fi Into a Password Trap — Live Since June, 3 Countries **URL:** \ **Category:** News & Articles\ **Tags:** hacking, privacy, networking, tips-tricks, news\ **Created:** [06.Август.2026 14:46:26 UTC](https://onehack.st/t/russian-hackers-turned-hotel-wi-fi-into-a-password-trap-live-since-june-3-countries/324493 "2026-08-06T14:46:26Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\ **Post date:** [06.Август.2026 14:46:27 UTC](https://onehack.st/t/russian-hackers-turned-hotel-wi-fi-into-a-password-trap-live-since-june-3-countries/324493/1 "2026-08-06T14:46:27Z")
# 📡 Russian Hackers Turned Hotel Wi-Fi Into a Password Trap — Since June, in 3 Countries _you check in, you connect to the lobby wifi, you log into your work email… and a ghost in the router copies your password. no warning. address bar looks perfect._ **Active since June 2026 · fake Microsoft login sites like `m365-owa.com` · a spyware bug named “CornFlake” · victims across US cities, India & Saudi Arabia** Microsoft literally put out a hotel-wifi warning on Aug 1. Full breakdown from [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/) and the [ReliaQuest research](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html) that caught it. ![Wifi Router GIF](https://media.giphy.com/media/E0WTowiGBVWT7eJHSb/giphy.gif) so basically the free wifi you trust the most — hotels, conference halls, that fancy coworking lobby — got turned into a pickpocket. and the wildest part? you’d never see it happen. no cap, this is the scariest kind of hack: the one where everything looks _normal_. > **🧩 Dumb Mode Dictionary** > > | Scary Word | What It Actually Means | > | --- | --- | > | **DNS** | The internet’s phone book. You type “[email.com](http://email.com),” DNS tells your phone the real address to go to. Poison the phone book, send people anywhere. | > | **Gateway/Router** | The box that hands out wifi. Whoever controls it controls where _everyone’s_ traffic goes. | > | **Session token** | A backstage pass your browser keeps so you don’t retype your password. Steal the pass, skip the password AND the 2-step code entirely. | > | **RAT** | Remote Access Trojan. Spyware that lets a stranger watch your screen, read your keys, grab your files. This one’s nicknamed “CornFlake.” | > | **WPAD** | A lazy Windows feature that auto-asks the network “hey, any proxy I should use?” Attackers just… answer yes. | > | **APT28** | A Russian government-linked hacking crew. State-sponsored, patient, professional. Not some kid in a basement. | > **🕰️ How we got here** > > Security firm [ReliaQuest](https://www.reliaquest.com/) noticed something weird starting **June 2026** : business travelers getting their Microsoft 365 work accounts hijacked, but nobody clicked a dodgy email. > > The trick? Attackers quietly took over the **wifi gateway boxes** at hotels and shared venues. That box does DNS for every guest. So when you type your normal Outlook web address, the poisoned box secretly sends you to a look-alike fake — `m365-owa.com`, `owa-ms365.com`, `ms365-device.com`, `ms365-live.com` — that looks _exactly_ like the Microsoft login. You type your password. They keep it. You get logged in for real, so you never notice. > > > The address bar looked 100% correct. That’s what makes DNS poisoning nasty — the URL is _right_, the page is _wrong_. > **🛠️ What the hack actually does (the 3 combos)** > > - **Fake login harvest** → clones Microsoft 365 sign-in pages, steals passwords AND the session token (so your 2-step code doesn’t save you). > - **Fake “software update” popups** → the hijacked wifi shoves a “please update” box at you. Click it, you install **CornFlake** — spyware that logs keys, screenshots your screen, and steals files. ([The Hacker News writeup](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)) > - **The WPAD trick** → abuses a Windows auto-setting so your PC routes traffic through _their_ server without you doing anything. ([Microsoft’s own explainer on WPAD](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/automatic-proxy-discovery-wpad-behavior) if you’re nerdy.) > **📊 The receipts** > > | Detail | Number | > | --- | --- | > | Active since | June 2026 | > | Countries hit | US, India, Saudi Arabia | > | Industries targeted | Finance, law, healthcare, energy, retail | > | Fake domains spotted | `m365-owa.com`, `owa-ms365.com`, `ms365-device.com`, `ms365-live.com` | > | Spyware name | CornFlake (RAT) | > | Suspected crew | FrostArmada / [APT28](https://en.wikipedia.org/wiki/Fancy_Bear) (Russia-linked) | > | Same trick used earlier | Home routers, earlier in 2026 | > **🗣️ What the timeline's saying** > > - IT admins: “great, now every business trip is a security incident waiting to happen.” > - [Forbes ran a straight-up warning](https://www.forbes.com/sites/zakdoffman/2026/08/01/microsoft-issues-hotel-wi-fi-warning-for-windows-pc-users/) telling Windows users to treat hotel wifi as hostile. > - The reformed-paranoid crowd: “this is why i’ve used a travel router + VPN since 2019, laugh at me now.” > - Everyone else: slowly realizing “free wifi” was never free — you were just paying in trust. #### Cool. A Ghost Lives in the Lobby Router… Now What the Hell Do We Do? (⊙\_⊙) ![Internet Router GIF](https://media.giphy.com/media/o4AAWagK1VTo90xh8a/giphy.gif) here’s the thing — every time the big companies get scared, a gap opens up. millions of travelers just found out their #1 habit is dangerous, and they have NO idea what to do about it. that panic? that’s a door. these plays ride the exact fear this news created. move while it’s hot. > **📡 The Rogue-Router Snitch** > > Venues have NO way to know their own wifi box got poisoned. You build a dead-simple check: connect to a venue’s wifi, run a free DNS-tamper test, and hand the manager a one-page “clean / compromised” report. Boutique hotels and coworking spots will pay to prove they’re safe — because one breach story kills their bookings. > > The whole test is basically comparing what their wifi says vs. what a trusted DNS ([Cloudflare’s 1.1.1.1](https://1.1.1.1/) or [Google’s 8.8.8.8](https://developers.google.com/speed/public-dns)) says. If they don’t match, something’s rotten. > > 🧠 _Example:_ A 24-year-old IT student in **Lahore, Pakistan** walks into 15 local co-working spaces, runs a free [dnschecker.org](https://dnschecker.org/) comparison + a [Wireshark](https://www.wireshark.org/) DNS capture, and offers a monthly “Wi-Fi Safe Seal” sticker for the lobby for $40/venue/month. Signs 9 of them = $360/month recurring for a 20-minute visit each. > > > 📈 **Timeline:** First paying venue in ~1 week (fear sells fast). Plateau in 3-4 months once you’ve hit every local spot — then franchise the checklist to a buddy in the next city. > **🧳 The Road-Warrior Safety Kit** > > Everyone hyped about the danger; nobody wants to learn networking. So sell the boring shovel: a pre-configured **travel router** that makes ANY hotel wifi safe. You plug their box in, it hides behind your device, VPN baked in, DNS locked. Traveler just connects to YOUR mini-router, never the dirty one. > > You buy a [GL.iNet travel router](https://www.gl-inet.com/products/) (~$30-60), pre-load it with a VPN + locked DNS, print a 3-step card, and resell the _setup_ — not the hardware, the peace of mind. > > 🧠 _Example:_ A 29-year-old gadget reseller in **Manila, Philippines** bundles a GL.iNet Beryl + a year of a cheap VPN + a laminated “how to stay safe” card, sells the kit to traveling sales reps and consultants on local marketplaces for a clean markup. Moves 40 kits in a month riding the news headline. > > > 📈 **Timeline:** First sales in days if you post while the story trends. Demand fades ~6-8 weeks after the scare cools — so front-load your marketing NOW. > **🎣 The Fake-Portal Fire Drill** > > Companies are freaking out that their traveling staff will fall for fake login pages. You build a _harmless_ clone of a hotel wifi login screen and offer to “test” a company’s road warriors — send it to their traveling employees, see who types their password, hand HR a report on who needs training. > > It’s the same idea as a fire drill: you’re not the arsonist, you’re the guy who proves the smoke alarms work. Use a legit phishing-simulation tool like [GoPhish](https://getgophish.com/) (free, open-source) so it’s all above board and logged. > > 🧠 _Example:_ A 26-year-old freelancer in **Nairobi, Kenya** runs a one-time “travel phishing drill” for a 30-person law firm using GoPhish, delivers a clean PDF of results + a 1-page fix sheet, charges a flat $500 per drill. Two firms a month = solid side income. > > > 📈 **Timeline:** First client in 2-3 weeks (needs a warm intro to a manager). Each drill is repeatable quarterly — recurring if you keep the relationship. > **📖 The Niche Dictionary Play** > > When scary news drops, a NEW vocabulary appears overnight — “DNS poisoning,” “CornFlake,” “captive portal,” “session hijack” — and millions Google it, panicked, at 11pm. Be the first clean, dead-simple cheat sheet that explains it AND tells them exactly what to do. First comprehensive guide = the search-engine anchor everyone links to. > > You’re not selling anything at first — you’re building the page every worried traveler lands on. Then you slot in the travel-router kit and the safety checklist as your “recommended tools.” > > 🧠 _Example:_ A 22-year-old writer in **Jakarta, Indonesia** publishes “Is Hotel Wi-Fi Safe? The 2026 Traveler’s Survival Guide” — plain English, screenshots of the fake domains, a printable checklist — on a free [Notion](https://www.notion.so/) page + [Medium](https://medium.com/). Ranks for “hotel wifi safe” in weeks, then earns from affiliate links to VPNs and travel routers. > > > 📈 **Timeline:** First traffic in ~2 weeks, real search ranking in 1-2 months. This one _compounds_ — the page keeps earning long after the news fades, because people travel forever. > **🪟 The Patch-Window Sprint** > > Right now there’s a gap: Microsoft warned people, but 99% of hotels have NOT checked or updated their gateway boxes. That’s a 2-4 week window where you can be the “we already fixed it” hero to small hotel owners before the big security firms even send a sales email. > > Approach independent hotels (not chains — chains are slow) and offer a one-time “gateway hardening” — update firmware, lock DNS to a trusted resolver, kill the WPAD trick. In-and-out, flat fee, they sleep better. > > 🧠 _Example:_ A 31-year-old freelance network tech in **Cairo, Egypt** DMs 25 boutique hotels the day the Forbes warning drops, offers a $200 “traveler-safe wifi audit + lockdown,” closes 6 in the first two weeks = $1,200 while the fear is fresh. > > > 📈 **Timeline:** Best money is the FIRST 3-4 weeks after a headline. After that, awareness spreads, everyone’s “already handled it,” and the window slams shut. Sprint, don’t jog. > **🛠️ Follow-Up Actions** > > | Move | First Step Tomorrow | > | --- | --- | > | 📡 Router Snitch | Learn the [dnschecker.org](https://dnschecker.org/) vs local-wifi comparison, test your own home wifi first | > | 🧳 Safety Kit | Price a [GL.iNet travel router](https://www.gl-inet.com/products/) + a cheap VPN, build one demo kit | > | 🎣 Fire Drill | Spin up free [GoPhish](https://getgophish.com/), run a test drill on your own inbox | > | 📖 Dictionary | Draft the guide on [Notion](https://www.notion.so/), grab screenshots of the fake domains from the news | > | 🪟 Patch Sprint | Read up on locking a router’s DNS + disabling WPAD, then DM 5 local hotels | **⚡ Quick Hits** | If You Want To… | Do This | | --- | --- | | 🛡 Never get caught by this | Turn on a [VPN](https://www.wireguard.com/) BEFORE connecting to any public wifi — encrypts everything, DNS poison can’t touch you | | 🔑 Kill password theft dead | Use [passkeys / hardware keys](https://fidoalliance.org/passkeys/) — nothing to type = nothing to steal | | 🚫 Ignore fake “update now” popups | Only update software from the official app itself, NEVER from a wifi popup | | 📱 Skip hotel wifi entirely | [Tether to your phone’s hotspot](https://support.apple.com/en-us/111785) — your own data is way safer than the lobby box | | 🔍 Check if you’re already hit | Look at [aka.ms/365signins](https://mysignins.microsoft.com/) for weird logins from cities you didn’t visit | _the free wifi was never free. you were paying in trust — and someone just figured out how to cash it out._