Hotel & Public WiFi Malware: The Real Risks (and the Fix)

Why hotel and public WiFi is a genuinely different risk category

Home WiFi has one household on it, a router you control, and (hopefully) WPA2/WPA3 encryption you set up once and forget about. Hotel and public WiFi is the opposite on every count: dozens to hundreds of strangers share the same network at any given time, the router is managed by hotel IT staff who may not patch it for months or years, and the password — if there even is one — is printed on a card at the front desk and known to every guest who's stayed there that week.

The core technical problem is that on most hotel networks, once you're connected, other devices on the same network segment can potentially see your traffic unless it's individually encrypted (which HTTPS handles for web traffic, but not everything is HTTPS, and local network broadcasts can still leak information). This is fundamentally different from your home network, where the only other devices are ones you put there yourself.

Attackers also specifically target hotels and tourist-area public WiFi because the victim pool self-selects for people who are distracted, unfamiliar with the local network, and often dealing with unusual banking/work access already — exactly the profile that makes stolen credentials valuable. A compromised hotel network in a popular nomad or tourist destination can expose dozens of victims a day with a single piece of infrastructure, which is a much better return for an attacker than targeting one home network at a time.

Man-in-the-middle attacks on unencrypted networks

A man-in-the-middle (MITM) attack means someone else on the network positions themselves between your device and the internet, silently reading or altering traffic as it passes through. On an open or poorly-secured hotel network, this is far easier to pull off than most guests realize — it doesn't require hacking the router, just being on the same network and using widely available tools to intercept unencrypted traffic or trick devices into routing through an attacker's machine (a technique called ARP spoofing).

The practical impact: any traffic that isn't protected by HTTPS encryption can potentially be read in plain text — old app connections, some email clients, unencrypted file transfers, and DNS lookups (which can reveal exactly which sites you're visiting even if the content itself is encrypted). Attackers can also use MITM positioning to inject fake content into otherwise legitimate-looking pages, or to redirect specific requests to malicious servers without any visible change on your screen.

The good news is that HTTPS (the padlock icon, present on the large majority of modern websites) genuinely protects the content of that connection even over a hostile network — MITM on an HTTPS site can see that you visited a site but not what you typed into it. This is exactly why a VPN adds real value on hotel WiFi specifically: it wraps all your traffic, including the non-HTTPS parts and the DNS lookups, in a single encrypted tunnel before it ever touches the local network. See our WiFi abroad guide and VPN setup guide for how to set that up correctly.

Fake captive portals: the most common real-world attack

The captive portal — that login or "accept terms" page that pops up when you first connect to hotel WiFi — is one of the most exploitable moments in the entire travel-tech stack, because guests are trained to expect a page asking for information and to click through it without much scrutiny. Attackers exploit this in two ways.

First, by setting up a rogue access point with a name nearly identical to the real hotel network ("Hotel_Guest" vs. "Hotel-Guest-Free" vs. "HotelWiFi"), often with a stronger signal than the legitimate one so devices preferentially connect to it. Once connected, the attacker controls the entire captive portal experience and can present a fake login page that harvests your room number, last name, email, or even a credit card "for verification" — information that's often reused elsewhere.

Second, and increasingly common, is a fake portal that prompts you to install a "required" app, browser extension, or certificate to "access the network," which is in fact malware or a tool that lets the attacker intercept your encrypted traffic by installing a rogue root certificate. A legitimate hotel network will never require you to install software or a certificate to get online. If a captive portal asks for that, disconnect immediately. Similarly, be wary of any captive portal asking for a full credit card number or a password you use elsewhere — legitimate hotel portals typically only need a room number and last name, if anything at all.

How to tell if you've been compromised

Most malware picked up through a compromised network doesn't announce itself immediately, but there are consistent warning signs worth checking for in the hours and days after using hotel or public WiFi:

• Unexpected browser behavior — new toolbars, a changed homepage or default search engine, pop-ups appearing even when no browser tab is open, or being redirected to unfamiliar sites.
• Sudden slowdowns or high background activity — fans running constantly, the device warm when idle, or noticeably slower performance than before you connected.
• Security software disabled or acting oddly — antivirus that silently stopped updating, or a warning that it was disabled without your input.
• Login notifications or password reset emails you didn't trigger, especially for accounts you accessed while on that network.
• New browser extensions or a certificate you don't remember installing — check your browser's extensions list and, on Windows, the certificate store, if you recall a captive portal asking you to install anything.
• Unusual outbound network activity — data usage spikes with no obvious cause, which can indicate something on the device is communicating with a remote server in the background.

If any of these show up, don't wait — the longer malware sits on a device, the more it can spread, harvest, or entrench itself.

Remote malware removal and network hardening

If you suspect a device was compromised on hotel or public WiFi, the first step is to get it off that network — switch to your phone's mobile hotspot or a different connection while you investigate, since staying on a compromised network risks re-infection during cleanup. Then a proper scan is needed: a surface-level antivirus pass often isn't enough for network-delivered malware, which can include rootkits, rogue certificates, or browser hijackers that standard consumer antivirus doesn't always catch on the first pass.

This is exactly the kind of job RemoteFix 24/7 handles remotely: a technician connects to your device, runs a full diagnostic and multi-layer malware scan, removes rogue certificates or extensions, resets DNS and network settings that may have been tampered with, and checks for persistence mechanisms that would let an infection survive a simple restart. We also check whether any accounts logged into during the exposure window should be flagged for a password change — a five-minute step that closes the loop most people forget.

Going forward, the fix isn't to avoid hotel WiFi entirely (often unrealistic for travelers) but to harden how you use it: always run a VPN on public networks, never install anything a captive portal asks for, double-check network names with the front desk before connecting, and keep your device's OS and browser updated so known exploits are already patched.