Hidden Hotel-Room PC Sent 480,000 Phishing Emails Through Hotel Wi-Fi

A computer tucked behind a refrigerator in a Japanese hotel sent around 480,000 phishing emails over the hotel’s Wi-Fi. The unusual placement gave the operation a local internet connection while the machine was hidden from view. When it was found, investigators counted about 2.4 million email addresses stored on it, suggesting a much larger pool of potential recipients than the number of messages already sent.

Hackread reports that Ye Jiafeng, 39, and his wife, Shen Qi, 39, placed the computer in the room. The reported email campaign began on 15 May 2025, when Ye connected the machine to the hotel network and concealed it behind the refrigerator. The messages posed as communications from credit card companies and directed recipients to imitation websites designed to collect card details.

A hidden connection and a remote operator

The arrangement depended on an ordinary piece of hotel infrastructure: guest Wi-Fi. A computer connected to that network could send messages using the hotel’s internet connection, while its physical presence stayed out of sight. The source reports that the machine was likely managed remotely, which would have allowed someone to operate it without returning to the room to maintain it. That remote administration is described as a belief, rather than a confirmed account of how the system was controlled.

The hotel connection also left a trail. Metadata associated with the emails pointed to the hotel’s IP address. A recipient who received one of the messages contacted the hotel, and staff then found the computer. Without that report, the device might have continued operating unnoticed; the source doesn’t say how long it had been there before discovery.

The distinction between the machine’s stored addresses and messages already sent matters. The reported 480,000 emails describe activity that had taken place, while the 2.4 million addresses indicate what the computer contained when it was found. The source doesn’t establish that every stored address was valid, that each one received a message, or how many people entered information on the fake sites. Those figures describe the scale of the operation’s infrastructure, not a confirmed count of victims.

The email was only one part of the reported activity

The couple are also reported to have used card details stored on a smartphone to buy goods in Kobe. Media reports say 74 phones were found at their home. Since 2024, the pair allegedly spent 10 million yen, about $63,000, using card information obtained from other people. The available account doesn’t establish whether all 74 phones were used in those purchases or whether other devices were involved.

That separate activity points to a different use of stolen card data from the email operation. The phishing messages tried to persuade recipients to submit payment details through fake pages; the reported purchases involved using card information already stored on a phone. The source doesn’t explain how the phone data was obtained, how the purchases were connected to the hotel computer, or whether the same people controlled both operations.

That uncertainty extends to the operation’s structure. The source says it remains unclear whether Ye and Shen designed and directed the phishing activity themselves or acted for someone else. A hidden computer and a large address list show that the setup could send messages at scale, but they don’t reveal who built the fake sites, gathered the addresses, managed the email infrastructure, or received any information submitted by recipients.

Phishing services can lower the setup burden

The hotel-room computer is one example of a phishing setup built around a concealed device and an existing network connection. Other operations can reduce the amount of technical work required from the people using them. A phishing-as-a-service operation described by Tom’s Hardware reportedly helped customers create scam websites with AI assistance. The source says that service was believed to be responsible for nearly $2 billion in losses and 3.87 million stolen credit cards.

These examples involve different methods. A concealed computer supplies a connection and a place to run the sending process; a service that helps users build fake sites offers a way to create the destination that messages point to. Both illustrate how phishing can be assembled from separate pieces: contact lists, convincing messages, websites that imitate trusted services, and infrastructure for collecting responses. The source doesn’t establish that the hotel operation used a paid service or AI-generated pages.

For organizations, the practical lesson is that a phishing message’s apparent sender is only one clue. In this case, the reported emails borrowed the identity of credit card companies, while metadata tied their delivery to a hotel connection. That kind of mismatch can give recipients and service operators a reason to investigate, though the account doesn’t detail what checks the hotel used after receiving the report.

The key open questions are how the address list was assembled, whether anyone submitted payment details, and who directed the operation. Until those are answered, the email and device counts show the reach of the setup but not its full impact. The discovery also underlines why reports from recipients can matter: one message led hotel staff to a computer that had been hidden from ordinary view.