By REBECCA RUTHERFORD
Los Alamos
For the Los Alamos Daily Post
Here’s one to file under “things that ruin business travel forever.” Microsoft just published research on a campaign where hackers hijacked hotel Wi-Fi networks… specifically the captive portal, that login page you click through before you get online… and used it to push fake browser and Windows updates to guests. Yikes!
The trick works because the hotel’s Wi-Fi gateway often doubles as the DNS resolver for every device on the network. What’s a DNS resolver? A DNS resolver is a server that translates human-readable web names into machine-readable IP addresses. Whoever controls that gateway controls where your laptop thinks it’s going. So instead of your normal “click to connect” screen, you might get a prompt to install a browser update, or worse, instructions to open a terminal and run a command to “fix a connectivity issue.” That second trick is called ClickFix, and it only works if the victim actually copies and pastes the command themselves. No click-and-you’re-infected magic; it needs your cooperation to install on your system, so you need to know what to watch out for.
The ClickFix version is trickier because it can’t just infect you with a click. Instead the page tells you something’s wrong with your connection and walks you through a “fix”: press Windows+R (or open Terminal on a Mac), paste in a command it’s conveniently already copied to your clipboard, and hit enter. The command looks like gibberish or a “diagnostic tool,” but it’s actually a PowerShell one-liner that silently downloads and runs a script in memory – no file left on disk to catch, no antivirus prompt, because you’re the one who ran it.
If someone falls for it, the payload is a piece of malware called CornFlake, which can quietly turn on your webcam and microphone, log your keystrokes, grab saved passwords and browser cookies, and even watch your clipboard. Researchers have also found a companion tool that specifically goes after Microsoft 365 and Azure login tokens, the kind of theft that can let an attacker slip into your cloud accounts without ever needing your password, and is a great way for an attacker to maintain persistence in your account.. Since mid-July, some of these fake portal pages have also tried to trick victims into approving a legitimate-looking Microsoft sign-in code, which would hand over an already-verified, MFA-satisfied login to the attacker.
What you can do: treat any hotel or public Wi-Fi as untrusted by default. Never install a software update, certificate, or “security tool” through a captive portal; legitimate updates never come from a hotel login page. If you travel often, a full-tunnel VPN that’s on before you ever load that portal page is one of the best defenses, since it keeps your DNS traffic away from the venue’s gateway entirely. And if a public network ever asks you to open a terminal and type something, close the browser, crack open a cold one, and call it a night. Cheers, and stay safe out there!
Editor’s note: Rebecca Rutherford works in information technology at Los Alamos National Laboratory.
