Your salesperson checks into a hotel the night before a Tuesday morning meeting, opens a laptop, and joins the guest Wi-Fi. The sign-in page loads. So does a notice saying the browser needs an update before the connection will work. That notice is the attack.
For most small businesses the right setup is a company-managed hotspot for anyone who travels regularly, with venue Wi-Fi kept as a fallback under one hard rule: nobody installs anything a Wi-Fi page offers them. A VPN still belongs in the picture. It just doesn’t solve this particular problem, and assuming it does is how people get caught.
What Actually Changed at Hotel and Conference Wi-Fi
Since early May 2026, attackers have been tampering with traffic on networks that sit behind a captive portal — the sign-in page you have to clear before you are really online. A threat-intelligence advisory published July 31, 2026 described malware “purporting to be browser or operating system updates in response to automated connectivity checks issued by users’ browsers.” The activity turned up at hotels, and also at conference centres and other shared venues. The stated goal was reaching the accounts of business travellers.
The connectivity check is the part worth understanding. Every laptop, the moment it joins a network, quietly requests a known page to work out whether it has real internet or is stuck behind a sign-in screen. That silent request is what makes the “Sign in to Wi-Fi” window appear on its own. When somebody else controls the network, the same automatic request can be answered with a fake update page instead of the real portal. Nobody clicked a bad link. The laptop asked a question and got a hostile answer.
What lands afterward is a remote-access tool: file collection, keystroke capture, stolen passwords, and stolen session tokens. That last one matters more than most owners expect, because a stolen session token walks straight past a login that already cleared multi-factor.
Four Ways Your Team Can Get Online Away From the Office
The real question was never “public Wi-Fi, yes or no.” It is which connection your people reach for first, and what they have been told to do when the first choice isn’t there.
| Connection | Who controls it | Exposure to portal prompts | What it costs | Use it when |
|---|---|---|---|---|
| Company-managed hotspot | Your mobile carrier, under your IT policy | None — there is no sign-in page | Device cost plus a line on the mobile bill | Default for anyone travelling monthly or more |
| Tethering to a personal phone | The employee’s carrier | None — there is no sign-in page | The employee’s data allowance and battery | Occasional trips and short working sessions |
| Venue Wi-Fi plus a VPN | The venue and whoever manages its portal | Full — the portal runs before the tunnel | Already paid for | Large files or genuinely unusable cell signal |
| Venue Wi-Fi on its own | The venue and whoever manages its portal | Full, with nothing behind it | Free | Never, for anything touching work accounts |
Read the second column first. Whoever controls the connection decides what your browser gets shown, and that authority sits upstream of every security tool running on the laptop.
Does a VPN Protect You on Hotel Wi-Fi?
Partly. A VPN encrypts your traffic once the tunnel is up, so nobody else on the network can read what you send. It does nothing about the sign-in page, because that page has to load before the tunnel can exist. Everything the portal puts in front of you happens outside the VPN’s reach.
The advice to use a VPN on public Wi-Fi was written for a different problem. It was aimed at snooping, and snooping has largely been solved by the web itself. The Federal Trade Commission now tells consumers that widespread encryption has made public Wi-Fi usually safe.
The same page draws the line that matters here. Scammers “create fake websites and encrypt them to make you think they’re safe when they’re not,” and if you land on one, your data may be encrypted on its way to the site “but it won’t be safe from scammers operating the site.” The padlock tells you the connection is private. It says nothing about who is waiting at the other end of it.
If the remote work security rules you handed staff still treat the VPN as the whole answer for anyone working outside the office, that section needs a rewrite.
The Update Prompt That Should Stop Everyone Cold
One rule covers most of this, and it is short enough that people actually keep it. Software updates never arrive from a Wi-Fi page.
Updates come from the operating system’s own settings screen, or from your IT provider. Nowhere else. If a page claims the browser is out of date, close the tab and check the browser’s own About screen. If a page says verification failed and asks somebody to copy a command into a terminal or a Run box, that is not a network problem — no legitimate venue has ever needed that. An unexpected request to sign back into company email on hotel Wi-Fi gets the same treatment: don’t type the password, open the app directly, and tell somebody.
A rule like that belongs in ongoing user training rather than a one-time onboarding slide, because the prompt gets a new look every few months and the rule doesn’t change.
Match the Setup to How Your Team Actually Travels
Choose a company-managed hotspot if anyone in the business travels monthly or more, works regularly from client sites, or touches email, banking, or customer records on the road. It takes the portal out of the picture completely, which makes it the only control here that doesn’t depend on somebody making a good decision while tired and late.
Tethering to a personal phone is a reasonable middle ground for occasional short trips. Same protection, with the tradeoffs landing on the employee’s battery and data allowance instead of your balance sheet.
Venue Wi-Fi with a VPN is the fallback, not the plan. Use it when a file is too big for a cell connection or the signal inside the building is genuinely unusable, and only with the update rule in force.
If you can’t say with confidence which of your people connect to what once they leave the office, that is the actual starting point. A free security risk assessment is a cheap way to find out before a business trip finds out for you.
Where the Hotspot Approach Genuinely Loses
A hotspot is a device, and devices have bad days. It costs a line on the mobile bill. It runs flat by mid-afternoon. It gets left in a hotel room. Inside a concrete convention hall the cell signal can be worse than the venue’s own network, which means the fallback gets used exactly when the room is fullest and the person is most rushed.
The bigger limit is what a hotspot doesn’t do. It protects the connection. It does nothing at all when somebody types a company password into a convincing fake sign-in page reached over that clean connection. The connection and the person are two separate problems, and hardware only solves one of them.
When we procure and deploy hardware for a client, a travel hotspot goes onto the asset list the same way a laptop does — issued to a named person, tracked, and returned. A hotspot bought mid-trip on a corporate card and expensed afterward is a device nobody owns. And because our remote monitoring and management runs on the laptops themselves, a machine that picked something up in a hotel room shows up in the same queue as a machine sitting in the office.
Questions We Get About Working From Hotels
Is the hotel’s wired connection any safer than its Wi-Fi?
Not meaningfully. The wired port in the room usually lands on the same network and the same sign-in page as the wireless does. The delivery method changes. The party controlling the traffic does not.
What should somebody do if they already installed the update?
Stop using that laptop for work and call your IT provider before doing anything else. Assume anything typed on the machine is exposed, including saved passwords and active sessions. Password changes and sign-out-everywhere have to happen from a different device, because doing it from the compromised one just hands over the new credentials too.
Do phones carry the same exposure as laptops?
Yes, and phones make it easier by rejoining familiar networks on their own. Researchers saw the same approach being pointed at mobile devices, with instructions to install an app file directly. The rule holds: nothing gets installed because a Wi-Fi page asked for it.
Find Out How Your Team Connects When They Travel
Most small businesses have never mapped this. They know who has a laptop. They don’t know which networks those laptops join in a normal month, whether anyone has been told what to do with a surprise update prompt, or which accounts would be reachable if one machine got taken on the road.
O&O Systems works with businesses across the Treasure Coast and South Florida on exactly that gap — the connections, the devices, and the people using them. Request a free security risk assessment and we will show you where your off-site exposure actually sits.