Public Wi-Fi networks have become an essential part of modern life. Whether at airports, hotels, shopping malls, coffee shops, or corporate guest networks, users frequently connect to wireless networks through a captive portal before gaining internet access. While captive portals provide convenience and help organizations manage network access, they have also become attractive targets for hackers. In recent years, cyber attackers have increasingly exploited weaknesses in captive portal implementations to steal credentials, distribute malware, intercept communications, and gain unauthorized access to devices and networks. As organizations continue to expand their digital footprint and offer public connectivity services, understanding the risks associated with captive portal attacks has become a critical component of cybersecurity strategy.

This blog explores the growing threat landscape surrounding captive portal attacks, how they work, their impact on businesses and users, and the measures organizations can take to protect themselves.

A Quick Overview of Captive Portal Attacks

A captive portal is the login or acceptance page that appears when you connect to a public Wi-Fi network, at a hotel, airport, coffee shop, or hospital. You have seen them thousands of times: a page asking for your email, a room number, or agreement to terms of service before granting internet access. These pages exist for legitimate purposes, but attackers have found them to be the perfect bait.

In a captive portal attack, a threat actor creates a rogue Wi-Fi access point that impersonates a legitimate network. When a victim connects, often automatically, because their device has connected to a network with that name before, they are presented with a convincing fake login page. The credentials they enter are harvested instantly. The attack combines an evil twin Wi-Fi setup with a phishing page, and it is devastatingly effective because victims expect to see a login screen. They walk right into the trap with zero suspicion.

Threats Associated with Captive Portals

As public Wi-Fi usage grows, captive portals continue to attract threat actors looking to exploit unsuspecting users.

1) Rogue Captive Portals

One of the most prevalent forms of captive portal attacks involves the creation of fake Wi-Fi networks that mimic legitimate public hotspots.

Attackers set up wireless access points with names similar to trusted networks, such as:

• Airport Free Wi-Fi
• Hotel Guest Network
• Coffee Shop Internet

When users connect, they are redirected to a fraudulent captive portal designed to collect credentials, payment details, or personal information.

2) Credential Harvesting Attacks

Hackers frequently use fake captive portals to steal usernames and passwords.

Victims may unknowingly enter:

• Corporate credentials
• Email account logins
• Social media usernames and passwords
• Cloud service authentication details

Once obtained, these credentials can be used for account takeover, credential stuffing attacks, corporate espionage, lateral movement within networks, or launching further phishing campaigns. For organizations that rely on single sign-on (SSO) systems, a single compromised credential can potentially provide attackers access to multiple business applications and sensitive resources.

3) Evil Twin Attacks 

An Evil Twin attack is a sophisticated variation of rogue Wi-Fi attacks. In this scenario, attackers create a wireless network that appears identical to a legitimate hotspot. Devices may automatically connect to the stronger signal, especially if users have previously connected to the original network. The attacker then presents a fake captive portal and captures user interactions. These attacks are particularly risky because users often have no visual indication that they are connected to a malicious network.

4) Malware Distribution Through Captive Portals

Some attackers use compromised or fake captive portals to distribute malware.

Users may be prompted to:

• Install browser extensions
• Download network access tools
• Install mobile applications
• Accept software updates

These downloads may contain:

• Remote access trojans (RATs)
• Spyware
• Keyloggers
• Ransomware

Once installed, the malware can provide attackers with persistent access to the victim’s device.

5) Session Hijacking

Poorly configured captive portals can expose users to session hijacking attacks. Attackers monitoring network traffic may capture session cookies or authentication tokens transmitted over unsecured connections. This allows them to impersonate legitimate users and gain access to active sessions without needing usernames or passwords. Organizations using outdated authentication mechanisms are particularly vulnerable to this threat.

Notable Attack Scenarios of Captive Portal Attacks

The following cases showcase how seemingly legitimate Wi-Fi login portals can be transformed into powerful vectors for cyberattacks. 

• UNC6384 Exploits Captive Portals to Deploy PlugX

Cyber espionage campaign uncovered by Google Threat Intelligence revealed how the China-linked threat group UNC6384 exploited captive portal attacks to target diplomats and high-profile organizations. The attackers hijacked public Wi-Fi login processes using an Adversary-in-the-Middle (AitM) technique and redirected victims to a fake software update page disguised as an Adobe plugin update. Once downloaded, the malicious file deployed PlugX malware, a powerful remote access trojan capable of data theft, keylogging, and remote system control. The campaign also used valid digital certificates and sophisticated social engineering tactics to make the attack appear legitimate, highlighting the growing risks associated with captive portal exploitation and public Wi-Fi networks.

• The Australian Airport Incident

Australian Federal Police charged an individual with operating fake Wi-Fi networks at three airports and aboard domestic flights. The attacker needed nothing more than a portable access point and a convincing network name. Dozens of passengers connected, were shown a cloned airline login page, and surrendered their email credentials, often the same passwords used for corporate accounts. The case proved that captive portal attacks require no special expertise or state sponsorship: a laptop and basic web skills are enough.

• DarkHotel and State-Sponsored Attack

The threat does not stop at opportunistic criminals. The DarkHotel advanced persistent threat (APT) group has targeted business travelers at luxury hotels across Asia since at least 2007, specifically hunting senior executives and research scientists through compromised hotel Wi-Fi and fake captive portals. More recently, Chinese state-affiliated operators have been observed hijacking captive portal checks to deliver digitally signed malware and deploy in-memory backdoors, a technique that leaves almost no forensic trace.

Russian military intelligence operatives have used evil twin setups near the buildings of international agencies, deploying rogue networks complete with working internet connections and convincing login pages to intercept sensitive communications from staff and visitors.

How Organizations Can Stay Protected from Captive Portal Attacks?

Protection Area	What to Do?
Network Segmentation	Separate corporate, guest, BYOD, and IoT networks using VLANs and firewall rules.
Strong Authentication	Use WPA3 Enterprise with certificate-based authentication instead of shared Wi-Fi passwords.
Always use a VPN	A reputable VPN encrypts all traffic before it leaves your device, rendering session interception useless even on a rogue network.
Zero Trust Access	Verify user identity and device security before granting access to resources.
Wireless Monitoring	Deploy wireless monitoring tools to detect rogue access points and suspicious Wi-Fi activity.

Protect your organization’s Wifi networks with vulnerability assessment to detect and mitigate captive portal attack risks before they impact your business. Identify network vulnerabilities early to prevent credential theft, unauthorised access, and data breaches.

Conclusion

Captive portal attacks have evolved from simple phishing attempts into sophisticated cyber threats capable of facilitating credential theft, malware deployment, espionage, and unauthorized network access. As demonstrated by incidents involving UNC6384, DarkHotel, and rogue Wi-Fi campaigns at airports, attackers continue to exploit the trust users place in public Wi-Fi login pages. For organizations, the risks extend beyond individual users to potential data breaches, operational disruption, and reputational damage. As the attacks continue to grow, proactive security measures and continuous assessment of network defenses are essential to reducing risk and maintaining a strong cybersecurity posture.

FAQs