Invisible trap in a luxury hotel
Hackers are compromising routers at international hotels and conference centers. Anyone who unsuspectingly connects to the Wi-Fi while on a business trip risks—in the worst-case scenario—losing control of the entire corporate network, often without even realizing it.
It is a classic scene from a modern business trip: after checking into a business hotel in Manhattan or on Berlin’s Friedrichstraße, there is hardly any time to unpack. A meeting with an international client awaits, and the laptop is flipped open. A click on the hotel’s Wi-Fi, the entry of a room number and surname on the welcome page, and the connection to the digital working world is established. It is a familiar, almost mechanical routine. Yet, in that very moment of inattention—caught between jet lag and the pressure of a tight schedule—the trap snaps shut.
Security researchers worldwide are currently sounding the alarm over a sophisticated cyber-espionage campaign known as "CaptiveCrunch." What makes it particularly insidious is that the attackers—suspected by intelligence agencies to be linked to a Russian actor—do not hack travelers' laptops; instead, they hijack the hotels' own digital infrastructure.
If the router redirects
Typically, a hotel’s Wi-Fi gateway acts like a digital mail carrier. It takes the address a guest types into their browser—such as the URL for Microsoft 365 or a corporate intranet—and forwards it to the correct server. However, in the case of the affected hotels, attackers gained administrative access to these routers. They manipulated the Domain Name System (DNS)—essentially the internet’s phonebook.
If a guest now enters the legitimate address of their cloud service, the hotel Wi-Fi responds with a lie. It silently redirects the browser to a deceptively authentic copy of the login page, which is hosted on the hackers' servers. Addresses like m365-owa.com imitate the original so perfectly that they are barely distinguishable when walking past.
To the victims, everything looks normal. The internet is working, the hotel logo lights up, and the login screen exactly matches the familiar corporate environment. Yet anyone who enters their login credentials here is handing them straight over to criminals.
The undermined security promise
It is particularly concerning how attackers circumvent supposedly secure two-factor authentication (MFA). Many companies lull themselves into a false sense of security because a password alone is often no longer sufficient to gain access to sensitive systems. To achieve this, the cybercrime architects employ a psychological ploy: they display a prompt for so-called "device code authentication" on the fake webpage. The stressed traveler is shown a code that they are asked to confirm on their smartphone. What the victim does not realize is that, at that very moment, the hackers are initiating a genuine login attempt with Microsoft in the background.
If the user enters the code on their mobile phone, they are not authorizing their own laptop, but rather the attackers' server. The hackers obtain a permanent digital pass (OAuth token) for the entire corporate network—without ever knowing the password. The consequences for affected companies are devastating. Once inside the system, attackers can steal sensitive patents, divert financial transactions, or undetected monitor the internal communications of DAX-listed corporations and law firms.
Conventional defense fails
The biggest problem for IT departments is the inability of end devices to defend against this type of attack. Because the manipulation occurs at the network level, standard protective measures often prove ineffective. Even users who have configured a secure public DNS service—such as Google’s—on their laptops remain unprotected; the compromised hotel Wi-Fi intercepts the unencrypted request and falsifies the response before it even leaves the hotel.
Moreover, the attack is by no means limited to the theft of passwords. In many cases, the perpetrators attempt to overwrite proxy configurations on Windows systems or—under the guise of urgent browser updates—trick users into installing sophisticated malware that extracts passwords directly from system memory.
The End of Digital Naivety
For business travelers, this new wave of attacks spells the temporary end of convenience. Cybersecurity authorities strongly advise treating hotel Wi-Fi networks like hostile territory during business trips.
The surest form of protection right now is simply to avoid these networks: anyone handling sensitive data should steer clear of hotel, airport, and conference center networks entirely and instead use their smartphone’s mobile network (LTE or 5G) as a hotspot. If using Wi-Fi is unavoidable, a "full-tunnel VPN" is essential; this ensures that all data traffic—including DNS requests—is fully encrypted from the very first moment and routed past the compromised hotel router.
Above all, however, the threat calls for a new culture of digital mistrust. If the routine login process in a hotel room deviates—even slightly—from the usual procedure at the office, the rule is now: close the laptop immediately. The client meeting will simply have to wait a few minutes.
How to protect yourself while traveling
- Benefits of mobile hotspots: Whenever possible, use the smartphone's mobile network (LTE/5G) instead of the hotel Wi-Fi.
- Always work with a VPN: Use a permanently active Full-tunnel VPN, which encrypts all data traffic (including DNS).
- Caution with device codes: Never confirm unexpected prompts for device pairing or password entry that pop up immediately after connecting to Wi-Fi.
- No updates at the hotel: Never download updates or security certificates offered when logging into a hotel network.