Credential Harvesting via Captive Portals: Documented Cases

What Are Captive Portals?

A captive portal is the web page that appears when you first connect to WiFi at a hotel, airport, coffee shop, or other public venue. It typically asks you to accept terms of service, enter a room number, provide an email address, or make a payment before granting internet access. Captive portals are the standard mechanism for controlling access on public WiFi networks.

The familiarity of captive portals is precisely what makes them dangerous. Users are conditioned to see a web page appear after connecting to WiFi and to enter information on that page without much scrutiny. A fake captive portal created by an attacker exploits this conditioning - it looks like the expected login page, but it sends entered credentials directly to the attacker.

Captive portal credential harvesting combines an evil twin WiFi attack (creating a rogue access point that mimics a legitimate network) with a phishing page (a fake login form that captures credentials). The combination is more effective than either technique alone because the victim expects to see a login page and enters information voluntarily.

The DarkHotel APT

The DarkHotel advanced persistent threat group has been targeting business travelers at luxury hotels since at least 2007, according to research published by Kaspersky Lab in 2014. The group specifically targeted senior executives and research scientists staying at high-end hotels in Asia.

graph TD
    subgraph "DarkHotel Attack Chain"
        A[Target Checks Into Luxury Hotel] --> B[Connects to Hotel WiFi]
        B --> C[Compromised Hotel Network]
        C --> D[Targeted Captive Portal for Specific Guest]
        D --> E[Portal Prompts Software Update]
        E --> F[Victim Downloads Backdoor]
        F --> G[Keylogger and Data Exfiltration]
        G --> H[Persistent Access to Target's Device]
    end
    subgraph "Target Selection"
        I[Senior Executives]
        J[R and D Scientists]
        K[Defense Industry Personnel]
        L[Government Officials]
    end

DarkHotel attack chain - compromised hotel WiFi infrastructure targeting specific high-value guests

DarkHotel's approach was more sophisticated than a simple fake captive portal. The group compromised the hotel's actual WiFi infrastructure, giving them control over the network that guests connected to. When a targeted guest connected, the compromised network served a custom captive portal that prompted the guest to install a "software update" - actually a backdoor that gave the attackers persistent access to the guest's laptop.

The targeting was precise. DarkHotel knew which guests they wanted to compromise and served the malicious portal only to those specific individuals, based on room number or device fingerprint. Other guests received the normal captive portal. This selective targeting made detection extremely difficult.

The group operated for at least seven years before being publicly identified, demonstrating that hotel WiFi attacks against high-value targets are not hypothetical - they are an established tactic used by sophisticated threat actors.

The Australian Airport Case

The 2024 Australian evil twin case (discussed in detail in our article on airport evil twin attacks) is the most recent documented criminal case involving captive portal credential harvesting. The suspect set up rogue WiFi access points at three Australian airports and on domestic flights, serving fake captive portals that requested email credentials.

Unlike DarkHotel, this was not a state-sponsored operation. It was allegedly a single individual with portable equipment conducting opportunistic credential harvesting. The case demonstrates that captive portal attacks do not require sophisticated resources - a laptop, a wireless adapter, and basic web development skills are sufficient.

How Fake Captive Portals Work

A fake captive portal attack requires three components: a rogue access point, a DNS server, and a web server hosting the phishing page.

graph TD
    subgraph "Fake Captive Portal Architecture"
        A[Rogue Access Point] --> B[DHCP - Assign IP]
        B --> C[DNS - Redirect All Queries]
        C --> D[Web Server - Serve Fake Portal]
        D --> E[Credential Capture Form]
        E --> F[Log Credentials to File]
        F --> G[Redirect to Real Internet]
    end
    subgraph "Portal Variants"
        H[Hotel WiFi Login Clone]
        I[Airport Free WiFi Sign-In]
        J[Sign In With Google Button]
        K[Pay for Premium WiFi Form]
    end

Fake captive portal architecture - DNS redirection presents a phishing page as the WiFi login

The rogue access point creates the WiFi network that victims connect to. The DHCP server assigns IP addresses to connected devices and configures the rogue AP as the default gateway and DNS server. The DNS server resolves all domain queries to the web server's IP address, ensuring that any URL the victim tries to visit redirects to the fake portal.

Modern operating systems automatically detect captive portals by trying to reach a known URL (Apple uses captive.apple.com, Android uses connectivitycheck.gstatic.com, Windows uses msftconnecttest.com). When the DNS server redirects these checks to the fake portal, the operating system displays the portal page automatically - the victim does not even need to open a browser.

Effectiveness Research

Academic research on captive portal phishing effectiveness has produced alarming results. Multiple studies have found that 30-60% of users will enter credentials on a convincing fake captive portal.

A 2019 study conducted in a controlled university setting found that 52% of participants entered their email credentials when presented with a fake "Sign in with Google" captive portal. Participants who were warned about WiFi security risks before the experiment still entered credentials at a rate of 38%.

The effectiveness increases when the portal mimics the visual design of the actual venue's WiFi login page. A fake portal that displays the hotel's logo, uses the same color scheme, and includes the hotel's terms of service text is significantly more convincing than a generic login page.

Interestingly, the effectiveness decreases sharply when the portal requests unusual information. Asking for a credit card number on a free WiFi portal, or requesting a password when the real portal only asks for a room number, triggers suspicion. The most effective fake portals ask for exactly what users expect to provide - email address and password for a "register to use WiFi" page, or room number and last name for a hotel portal.

What Gets Captured

The type of credentials captured depends on the portal's design. Common variants include:

Email credentials: "Sign in with Google" or "Sign in with Microsoft" fake OAuth pages capture email addresses and passwords. These are high-value credentials because email accounts often serve as the recovery mechanism for other accounts. Compromising an email account can cascade into access to banking, social media, and corporate resources.

Payment information: "Pay $4.99 for premium WiFi" or "Enter credit card for free trial" pages capture card numbers, expiration dates, and CVVs. These are immediately monetizable through fraudulent purchases or resale on underground markets.

Social media credentials: "Sign in with Facebook to continue" portals capture social media passwords. These accounts can be used for identity theft, social engineering, or resale.

Corporate credentials: In hotel or conference settings, portals mimicking corporate SSO (single sign-on) pages can capture domain passwords. These credentials provide direct access to corporate systems and data.

The BLEShark Nano Captive Portal Feature

The BLEShark Nano includes a captive portal capability designed for authorized penetration testing. Security professionals can use it to demonstrate the captive portal attack surface to clients during physical security assessments.

In an authorized engagement, the tester configures the Nano to create an access point with a captive portal, then measures how many employees connect and what information they provide. The results provide concrete, measurable data about the organization's vulnerability to this attack vector.

This testing is conducted with written authorization and follows responsible disclosure practices. The credentials captured during testing are reported to the client and securely deleted. The goal is to identify training gaps and policy weaknesses, not to compromise employee accounts.

The Nano's compact size and battery power make it practical to conduct these assessments in realistic locations - hotel lobbies, conference registration areas, and public spaces where employees might connect to WiFi during business travel.

Defending Against Fake Portals

The most effective defense against captive portal credential harvesting is simple: never enter real credentials on a captive portal. If a WiFi login page asks for your Google password, your corporate password, or your credit card number, close the page and use cellular data instead.

Legitimate captive portals typically ask for minimal information: agreement to terms of service, a room number, or an email address for a one-time registration. They do not ask for passwords to third-party services. Any captive portal requesting a password for Google, Microsoft, Facebook, or any other external service is either malicious or badly designed - either way, do not enter your password.

Use a VPN. If you must use public WiFi, connect to a VPN immediately after connecting to the network. The VPN encrypts all traffic, preventing the rogue AP from monitoring your activity. Some VPN providers offer "auto-connect on untrusted networks" features that activate the VPN automatically when you join an unknown WiFi network.

Use cellular data for sensitive activities. Banking, email, and corporate access should be conducted over cellular data whenever possible. The cellular connection is not vulnerable to evil twin or captive portal attacks.

Verify HTTPS and domain names. If you do enter credentials on a web page while on public WiFi, verify that the page uses HTTPS (padlock icon) and that the domain name is correct. A fake Google login at google-wifi-login.com is not Google.