Connecting to hotel Wi-Fi has become almost automatic.

You check in, get to your room, open your laptop or phone, select the hotel network, enter your information, and get connected.

For most travelers, it is simply another part of arriving at the hotel.

But recent cybersecurity research provides an important reminder:

We need to bring the same situational awareness we use in the physical world into our digital environment.

Security researchers have identified an ongoing campaign targeting Wi-Fi systems used by hotels, conference centers, and other hospitality locations. In some cases, attackers have compromised the infrastructure responsible for directing guests to the property's Wi-Fi login page.

That creates an important difference from the fake Wi-Fi networks travelers have traditionally been warned about.

You could connect to the legitimate hotel Wi-Fi network and still encounter a malicious redirect.

This doesn't mean you should stop using hotel Wi-Fi.

It means you should understand what the connection process normally looks like—and recognize when something doesn't fit.

Preparation is not fear. It's how you travel with confidence.

First, What Is a Hotel Wi-Fi Captive Portal?

You've probably used one hundreds of times without knowing its technical name.

A captive portal is the webpage that appears after you connect to Wi-Fi at a hotel, airport, conference center, coffee shop, or similar location.

Instead of immediately giving you full internet access, the network may redirect you to a page where you're asked to:

• Accept terms and conditions

• Enter your room number

• Enter your last name

• Provide an email address

• Enter a Wi-Fi access code

Once you complete the process, the network allows your device onto the internet.

Captive portals themselves aren't unusual. They're a standard way public Wi-Fi networks manage access.

The problem begins when an attacker gains control of part of that process.

This Is Different From the Fake Wi-Fi Warning You Already Know

For years, travelers have been warned about “evil twin” Wi-Fi networks.

Someone creates a network with a name that looks similar to the legitimate hotel network.

You might see:

Hotel_Guest

and

Hotel_Free_WiFi

One could belong to the hotel.

The other could belong to someone trying to intercept your activity.

That's why I've always recommended asking the hotel for the exact name of its guest network before connecting.

Keep doing that.

But this newer threat is different.

Researchers have observed attackers compromising Wi-Fi gateways used by hotels and conference centers. Because those systems help control where connected devices send their internet traffic, attackers can potentially redirect guests toward malicious infrastructure.

In other words:

You may have selected the correct Wi-Fi network.

The warning sign may come after you connect.

The Unexpected Microsoft Login

Imagine this.

You connect to your hotel's Wi-Fi.

A connection page appears.

Then you're suddenly asked to sign into your Microsoft account.

Because you're already expecting some type of login process, the request might not immediately seem unusual.

This is where situational awareness matters.

Ask yourself:

Why does this hotel need my Microsoft credentials to give me internet access?

That simple question can interrupt the process.

Researchers investigating this campaign observed Microsoft 365 impersonation pages designed to capture or abuse account authentication.

A hotel network may legitimately ask for information associated with your reservation or Wi-Fi access.

An unexpected request for your Microsoft 365 credentials or authorization is something very different.

Don't let the routine of connecting to Wi-Fi put you on autopilot.

Another Warning Sign: Device Authorization

Some attacks can be even more convincing because part of what you see may involve Microsoft's legitimate authentication system.

Researchers observed limited cases involving abuse of Microsoft's device-code authentication process.

The technical details aren't what travelers need to remember.

The practical lesson is:

Connecting to hotel Wi-Fi should not unexpectedly require you to authorize another device or enter a Microsoft device code.

If you're simply trying to get online and suddenly find yourself authorizing another device or account session, stop.

Something doesn't fit.

And Be Suspicious of Unexpected Updates

Another warning sign is a webpage telling you something on your device needs to be updated, repaired, installed, or reconfigured before you can use the internet.

You might see something claiming you need to:

Update your browser

Repair your network connection

Install a security certificate

Download a security tool

Update your computer

Don't proceed simply because the message appeared during the Wi-Fi connection process.

Your hotel Wi-Fi should not be responsible for updating your computer.

If your browser, operating system, or another application needs an update, use the normal update process built into that device or application.

Mike's Travel Tip

When something appears on your screen, don't just ask:

“Does this look legitimate?”

Ask:

“Does this request make sense for what I'm trying to do?”

You connected to Wi-Fi.

Why are you being asked for your corporate Microsoft credentials?

Why are you authorizing another device?

Why are you being told to download software?

Those are anomalies.

If it doesn't fit, stop.

You don't have to identify the cyberattack.

You just have to recognize that something has changed.

Seven Habits for Safer Hotel Wi-Fi

You don't need to become a cybersecurity expert before your next trip.

A few habits can significantly improve your digital travel safety.

1. Verify the Wi-Fi Network

When you check in, ask:

“What is the exact name of your guest Wi-Fi network?”

Don't automatically choose the strongest signal or the network name that looks most obvious.

This helps protect against traditional fake or “evil twin” networks.

It won't prevent every attack involving compromised infrastructure, but it removes one common opportunity.

2. Question What the Login Page Is Asking For

A professional-looking screen doesn't automatically mean it's trustworthy.

Ask whether the requested information makes sense.

Room number?

Possibly.

Hotel access code?

Possibly.

Your corporate Microsoft password?

Stop and reassess.

The same principle applies to Google, Apple, banking, social media, and other account credentials.

3. Don't Install Unexpected Updates

If the Wi-Fi connection suddenly tells you to install software, certificates, browser updates, security utilities, or troubleshooting tools, don't proceed.

Close the page.

Perform legitimate updates through your device's normal settings or official application.

4. Use Cellular Data for Sensitive Activity

Convenience doesn't always need to win.

If you're accessing banking information, sensitive business documents, financial accounts, or other important information, consider using cellular data or your personal hotspot instead.

Not every online activity requires the same level of protection.

5. Use a Reputable VPN When Appropriate

For business travelers, your organization may already require a corporate VPN.

ReliaQuest found that properly configured always-on, full-tunnel corporate VPNs can mitigate this particular gateway-level DNS attack because DNS and other traffic are routed through trusted corporate infrastructure instead of the hotel's gateway.

For personal travelers, a reputable VPN can also provide another layer of protection.

But remember:

A VPN is a tool for the toolbelt.

It doesn't make every screen trustworthy or every download safe.

6. Turn Off Automatic Wi-Fi Connections

Your device doesn't need to automatically connect to every familiar or open network it encounters.

Review your settings and disable automatic connection to unknown public networks.

When your hotel stay ends, consider having your device “forget” the network.

7. When Something Doesn't Fit, Stop

This is where cybersecurity and physical situational awareness come together.

In the physical world, you learn to recognize anomalies.

A door that should be locked but isn't.

Someone who appears to be following you.

Something in the environment that simply doesn't belong.

Digital situational awareness works the same way.

Unexpected account authorization?

That doesn't fit.

Mandatory browser update?

That doesn't fit.

A request for information unrelated to your hotel stay?

That doesn't fit.

You don't need to determine exactly what kind of cyberattack you're seeing.

Recognize the anomaly and stop.

What If You Already Entered Your Information?

Don't panic, but do take action.

First, disconnect from the Wi-Fi network and move to a trusted cellular or other private connection.

If you entered a password into a suspicious page:

• Change the password using the trusted connection.

• Change it anywhere else you've reused that password.

• Review recent account activity for unfamiliar logins.

• Make sure multifactor authentication is enabled where available.

If this involved a work account or company-issued device, contact your organization's IT or security team promptly.

Don't wait until you return from the trip.

And if you downloaded or installed something because of an unexpected Wi-Fi prompt, stop using that device for sensitive activity until it can be properly evaluated.

If it doesn't fit, stop.

Digital Safety Is Travel Safety

You don't have to predict every possible problem before you travel.

You prepare yourself to recognize when something has changed—and know what to do next.

That same approach is part of building your overall Travel Safety Plan.

That's situational awareness.

Whether you're walking through an unfamiliar city, checking into a hotel, or connecting your laptop to the hotel's Wi-Fi, the principle remains the same.

Your digital security can be part of the same arrival routine you use to check your physical environment. See Before You Unpack: A Hotel Room Safety Routine Every Traveler Should Know for the rest of that hotel safety routine.

Pay attention to the environment.

Recognize what doesn't belong.

Know your options.

Preparation doesn't take away from the experience.

It gives you more confidence to enjoy it.

Learn. Prepare. Explore.

Travel with confidence.