I checked into a hotel a few weeks ago while attending a conference. After a long day of traveling, the first thing I did when I got to my room was connect to the Wi-Fi so I could watch the end of a World Cup game on my laptop.

I didn’t think twice about providing my name and room number, clicking through the user agreement, and connecting to the internet.

Like many traveling professionals, I had come to view guest Wi-Fi almost like running water in the hotel room — more necessity than convenience.

But that convenience can also give cybercriminals another opportunity to gain access to corporate networks.

How Hackers Can Exploit Hotel and Public Wi-Fi

In a July 2026 article, cybersecurity threat detection company ReliaQuest reported activity by a group of threat actors associated with Russia’s Main Intelligence Directorate. The group, known as Storm-2945, was targeting travelers in an effort to steal login credentials and infect computers with malware.

The campaign took advantage of vulnerabilities in the captive portals used by public Wi-Fi networks in hotels, convention centers, hospitals, and other locations. A captive portal is simply the webpage that pops up when users connect to public Wi-Fi and asks them to register or accept terms before getting online.

The attackers used a technique known as DNS poisoning to quietly redirect internet traffic from devices connecting to public Wi-Fi through infrastructure they controlled.

Think of it like a truck driver receiving directions from a dispatcher to an unfamiliar destination. The directions appear legitimate, so the driver has no reason to question them. But the person giving the directions is an impostor who is deliberately sending the truck — and its load — somewhere else.

Fake Microsoft Login Pages Can Steal Credentials

According to Microsoft, Storm-2945 used fake webpages designed to look like Microsoft 365 login screens. When users entered their usernames and passwords, the attackers captured those credentials.

With stolen credentials, attackers could gain access to corporate computers and servers. From there, they could steal company files, record keystrokes, and potentially access built-in cameras and microphones to eavesdrop on meetings and conversations.

The attackers also could redirect compromised computers to fake operating system or browser update sites that installed malware. Once installed, that malware could provide another route into the company’s network.

An experienced truck driver might not know every turn on the way to an unfamiliar destination, but he or she will often recognize when the directions don’t make sense. Maybe the instructions say to travel north when the nearest major city is south. Maybe the roads don’t match expectations, or signs never mention the destination.

Those are reasons to stop and verify the directions with a trusted source rather than continuing blindly. The same principle applies online.

How Truck Drivers Can Use Public Wi-Fi More Safely

Truck drivers and other mobile employees often need internet access to conduct business or keep in touch with family while away from home.

When possible, one of the safest approaches is to avoid public Wi-Fi altogether and use a cellular connection, such as a smartphone hotspot or another mobile hotspot device.

When public Wi-Fi is necessary, fleets can use additional safeguards to reduce the risk.

One is phishing-resistant multi-factor authentication, or MFA. Unlike MFA methods that rely on codes that can potentially be intercepted or entered into a fraudulent website, phishing-resistant MFA uses credentials tied to the legitimate device and website. That makes it much harder for an attacker to reuse stolen login information.

A virtual private network, or VPN, also can help protect data by encrypting information traveling between the user’s computer and its destination. If attackers intercept the traffic, encryption makes the information much harder to read.

Fleets Can Add Layers of Cybersecurity Protection

Fleets also can apply security controls behind the scenes.

For example, conditional access policies can evaluate factors such as where a login originates and whether that location makes sense based on the employee’s expected travel.

Security systems can also flag suspicious sign-ins. If someone logs in from New York City and then appears to log in from Los Angeles a minute later, for instance, the system can block access or alert the IT team.

Larger organizations may combine several of these protections through what is known as a security service edge, or SSE, approach. The goal is to create multiple layers of defense rather than relying on any single cybersecurity tool.

Cybersecurity Training Matters for Drivers and Mobile Employees

Technology alone won’t solve the problem.

Fleets need a culture where drivers and other mobile employees are comfortable contacting the IT team when something doesn’t seem right.

Basic cybersecurity training can help employees recognize warning signs and trust their instincts when their online experience feels unusual. They should be skeptical when unexpectedly asked to enter a username and password or when prompted to install an update from a webpage they do not recognize.

Just as a professional driver learns to recognize when directions or road conditions don’t add up, employees can learn to recognize digital warning signs before an attacker gets farther into the network.

Cybersecurity Resources for Trucking Fleets

Motor carriers of all sizes can take advantage of cybersecurity resources from government agencies such as the Cybersecurity and Infrastructure Security Agency, or CISA, as well as industry organizations such as the National Motor Freight Traffic Association.

Fleets also may want to provide continuing cybersecurity education for their IT teams. Events such as the NMFTA Cybersecurity Conference offer sessions from cybersecurity professionals and trucking industry experts on threats, industry practices, and approaches to protecting transportation networks.

Public Wi-Fi is likely to remain part of life on the road. Treating it as a potential cybersecurity risk — rather than simply another hotel or travel amenity — can help fleets keep a convenient connection from becoming an entry point into the company network.

About the Author: Ken Heskett is a cybersecurity engineer at the National Motor Freight Traffic Association. He collaborates with industry partners, academic institutions, and government agencies to strengthen cybersecurity practices and knowledge sharing across the transportation sector. He holds the Certified Information Security Auditor (CISA), Certified Internal Auditor (CIA), and Certified in Risk Management Assurance (CRMA) designations and is a regular presenter at cybersecurity conferences and a contributor to professional journals.

This article was authored and edited according to Heavy Duty Trucking’s editorial standards and style to provide useful information to our readers. Opinions expressed may not reflect those of HDT.