A 44-year-old man has been sentenced to prison for orchestrating a scheme involving fake “evil twin” WiFi networks at several airports across Australia. His criminal activities extended beyond this, as he was also found guilty of hacking into the online accounts of women to steal intimate content.

Utilizing a portable wireless access device known as a WiFi Pineapple, he targeted individuals at Perth, Melbourne, and Adelaide airports, as well as those on domestic flights. The device was designed to intercept requests from people attempting to connect to WiFi networks in these locations.

Upon detecting such a request, the WiFi Pineapple would immediately generate an identical network with the same name, deceiving devices into recognizing it as a legitimate and trusted network. Consequently, devices would connect automatically, without the users’ knowledge.

Once connected, unsuspecting individuals were directed to a webpage that prompted them to log in using their email or social media accounts, thus exposing their credentials to the hacker’s scheme.

The device would then connect automatically.

The network took unsuspecting people to a webpage where they were prompted to log on using an email or social media account.

That data was then saved on the man’s device.

The man then illegally accessed social media and other accounts linked to women to monitor communication and steal private and intimate images and videos.

The AFP was alerted in April 2024 after an airline reported staff had found a suspicious WiFi network which mimicked a legitimate one point on a domestic flight.

Investigators searched the man’s hand luggage when he arrived at Perth Airport from interstate.

A portable wireless access device, laptop and mobile phone were seized. 

A search warrant was executed at a home in Perth’s Palmyra.

Forensic analysis identified thousands of intimate images and videos, personal credentials , and records of fraudulent WiFi pages.

The day after the search warrant, the man deleted 1752 items from his account on a data storage application and unsuccessfully tried to remotely wipe his mobile phone.

Later that month the man used a computer software tool to access his employer’s laptop to access confidential online meetings between his employer and the AFP regarding the investigation.

AFP Commander Renee Colley said the AFP remained “committed to the identification of cybercriminals who used sophisticated technology”.

“Cybercrime is a growing global threat, and our investigators are relentless in tracking down criminals who attempt to exploit digital anonymity to attack our community,” Commander Colley said.

“The AFP’s message to the community is to please be vigilant when connecting to any kind of free WiFi network, especially at public places such as airports.

“A network that requests your personal details – such as an email or social media account – should be avoided.

“If you do want to use public WiFi, ensure your devices are equipped with a reputable virtual private network (VPN) to encrypt and secure your data. Disable file sharing, don’t use things like online banking while connected to public WiFi and, once you disconnect, change your device settings to ‘forget network’.

“People should also switch off the WiFi on their devices to prevent them being automatically connecting to a hotspot in public spaces.”

The man pleaded guilty to multiple charges, including five counts of cause unauthorised access or modification of restricted data, contrary to section 478.1 of the Criminal Code (Cth) and three counts of attempt to cause unauthorised access or modification of restricted data, contrary to section 478.1 of the Criminal Code (Cth).

He will spend seven years and four months’ in jail, with parole after five.

The man was sentenced in Perth District Court yesterday.