Hotel Wi-Fi Trap Steals Traveler Data, Passkey Weakness Discovered

Two new threats are affecting travelers and account security this month. Neither requires panic, but both deserve your attention if you stay in hotels or use modern password replacements.

Russian Scammers Target Hotel Wi-Fi Users Worldwide

Cybercriminals are running a coordinated campaign to steal information from people logging into hotel Wi-Fi networks. The tactic is straightforward: they set up a fake or compromised Wi-Fi access point in a hotel, and when you connect to check email or browse, they intercept your data.

This works because hotel networks are often open to anyone in the building, and travelers are in a hurry. You connect without questioning it, log into accounts, and the attackers sit between you and the internet, capturing what you send and receive.

The protection is simple. Never log into sensitive accounts—banking, email, work, shopping—while connected to a hotel Wi-Fi without a VPN (a tool that encrypts your traffic so no one between you and the internet can see it). Many hotels also offer password-protected networks. Use those instead. Better yet, use your phone's personal hotspot to connect your laptop if you need to do important work.

Google Passkeys Have a Master Key—and It Can Be Stolen

Google and other tech companies are promoting passkeys as the future of account security. A passkey is a biometric login method—fingerprint or face ID—that replaces passwords. Sounds safer, and in many ways it is.

But new research shows a flaw: if you store passkeys across multiple devices using Google's synchronization feature, they're all protected by a single master key. If malware steals that master key, an attacker gains access to all your passkeys at once.

This doesn't mean you should avoid passkeys. It means if you use them, keep your devices clean of malware (use antivirus software, don't click suspicious links), and consider using passkeys only on devices you trust most. For accounts that matter most to you—email, banking—this is still a conversation worth having with your account provider about what security method fits your comfort level.

Both of these threats are real, but both are preventable with straightforward habits. Travel safely, keep your devices clean, and you're well protected.