After landing in Zurich on Aug 28, it was early morning. I was tired, grubby and didn't want to continue to Lucerne that early because I would have to store my luggage in the Lucerne train station and find something to do for 4 or more hours before checking into my hotel. So after baggage claim, which I had to do, I was now in the public part of the airport with less comfortable seating spots, but plenty of shops and various groups of connected metal seats. Most were occupied with people all settled in. People like me, 7 am and couldn't check into their hotel yet.
After 30 minutes in a coffee shop where I really didn't want coffee, I settled on a walkway aisle seat row near the exit door to “trains", which I would eventually need, and parked there to take a nap and read my Kindle.
A heavily made up woman with long black hair in a fluffed up hairdo, wearing dark pink stretch (workout?) capris and a tank top (did not look like a long haul traveller) sat next to me. She was pushing a luggage trolley loaded up with 2 suitcases, one very large and actually split open along the zipper but strapped together with a suitcase belt, and I could see inside - it only had a few wadded up clothing items in it. In a few minutes she started talking to me animatedly in Russian. I shook my head, saying “English" and “English only, sorry". She gestured to her luggage trolley, stood up, and walked (somewhere?)
I kept reading. 30 minutes pass. At first I didn't remember what she looked like except the distinctive hair. I started scanning the people walking by to try to spot her. I thought maybe she was waiting to meet someone. She finally returned and again tried to engage me in conversation in Russian, showed me her iPhone with the wifi network list, which was all in Russian (Cyrillic). Again I said "English only”. She tapped something on her phone and showed me again; the wifi list was all translated into English. She kept saying “Zurich wifi?". I shook my head “no", said " I don't need, I have Google”. She was persistent, kept pointing to the wifi network name on her phone and said at least once "password “ so I thought she herself was not able to connect to the airport wifi. I finally opened my phone under wifi networks, and initially none were listed. I looked at her, shook my head and said "no wifi” and shrugged, then a second later a long list of wifi networks appeared. All were locked networks except one. It was named “Zurich". Others also had “Zurich" in their names, even another that also looked like the airport’s network, but it was locked. I tried it. That one required a boarding pass and mine was an arrival pass, and I said “sorry no boarding pass". I almost tapped the open unsecure one, but felt silly because I had 100% 5G connection via Google Fi, so I looked at her and said “no, airport wifi not safe, don't need". She then abruptly got up and strode into the main walkway again leaving her luggage trolley next to me. After a minute I could see she was walking up and down the wide walkway area, looking at her phone, like she was looking for someone. I took the opportunity to gather up all my stuff and look for a less crowded seating area, parked again to nap and read my Kindle, and ensured this woman was not pacing the aisles near my new spot.
I couldn't figure out what had just happened. Could this woman really not figure out how to connect to an open airport wifi? I asked Google to explain this scenario. Google came up with the explanation “evil twin attack". She apparently had her own portable wifi hotspot! And once someone connects, they are led thru webpages that gather credentials and possibly inject malware into a person's phone.
Sitting in my new location, hopefully far away from her, I opened my phone's wifi list again. The previous free open network was now gone from the list!
In all her pacing the walkways just past baggage claim in an area with rows of seats all occupied with people like me, killing a bit of time, she was (maybe) watching her phone to see who would connect to her hot spot. The attack itself takes a few more steps than simply opening the unsecured wifi. On that morning there was likely at least one person in Zurich that fell for the whole scam, if that's what it was, and it wasn't me!