Cyberpediaby Brain
ENDEFR

Working in a coworking space

Shared Wi-Fi, curious neighbours, strangers asking questions: the risks of a coworking space and the reflexes an employee needs.

In 30 seconds

Where it happens
On the space's Wi-Fi or wired network, in the kitchen, at reception, anywhere a conversation starts.
What the attacker wants
To sit between your computer and the Internet to read or alter what passes through, or to gather information about you and your company through conversation.
The reflex
Give no information about your company to someone you do not know is entitled to receive it, and verify their identity through a channel you choose yourself.
If it has already happened
Tell your organisation's security staff right away, then change the passwords concerned.

What it is

In a coworking space, an employee shares a room, a connection and sometimes a desk with people they do not know. Neighbours change from one day to the next, and nothing shows who works for whom.

This entry describes what the sources cited here say about the situations that arise there: a Wi-Fi network that others can imitate, a device plugged into the network, a stranger asking questions. These sources cover neither privacy filters, nor lockers, nor VPNs, so the entry says nothing specific about them.

Straight answers

Why does coworking change the risk?

Because the setting is shared. The network is not your company's, the people around you are not colleagues, and a visitor draws no attention. The sources cited here describe general techniques (traffic interception, added hardware, social engineering) that find easy ground in this setting.

What can someone do who gets in the middle of the network?

MITRE describes the adversary-in-the-middle technique: the attacker positions themselves between two networked devices to collect information or act on what flows between them1. They can intercept credentials, including access tokens and session cookies1. Among the sub-techniques listed, one is named "Evil Twin"1.

Can a stranger plug hardware into the network?

MITRE describes it: adversaries can physically introduce an accessory, a network device or another device into a system or network to gain entry2. Among the capabilities cited is adding new wireless access points to an existing network2. The same page notes that public references to use by real attackers are scarce, while many penetration testing teams use it for initial access2.

Can information be extracted from me without any hacking?

Yes. CISA describes a social engineering attack as the use of human relationships to obtain or compromise information about an organisation or its systems3. The attacker can seem unassuming and respectable, claim to be a new employee, a repairer or a researcher, and even present credentials3.

What if I think I have given away sensitive information?

CISA advises reporting it to the relevant people in the organisation, including network administrators, who can watch for unusual activity3. The disclosed passwords must also be changed without delay, along with those of every account where the same one was used3.

1How it works2 min

Two families of risk mix in a shared space: those that go through the network and those that go through people.

On the network side, MITRE explains that the attacker abuses features of common protocols, such as ARP or DNS, to force a device to communicate through a system they control1. They can also change a victim's DNS settings to divert them from legitimate sites or push malware to them1. Another route is to negotiate a weaker version of a communication protocol or an encryption algorithm1.

Plugged-in hardware is part of the picture too. The DarkVishnya group, cited by MITRE, physically connected a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops to the targeted organisation's environment to reach its local network2.

On the people side, information gathering has a name: MITRE speaks of phishing for information, whose goal is to collect data from the victim rather than to run malicious code4. It goes through emails, instant messages or other exchanges, and can also direct the victim to a phone number where the attacker tries to collect confidential information4. The attacker often poses as a source with a reason to ask, and sometimes sends several messages that look urgent4.

CISA adds a mechanism that coworking favours: if the attacker does not get enough information from one person, they contact another in the same organisation and rely on what the first said to appear credible3. A harmless answer given at the coffee machine can therefore serve as a foothold for the next question.

2What you do1 min
  • Verify the identity of anyone claiming to come from a legitimate organisation, directly with that organisation3.
  • Be wary of unsolicited calls, visits or messages about employees or internal information3.
  • Give no personal information and no information about your company, including its structure or networks, unless you are certain the person is entitled to receive it3.
  • Take certificate errors seriously: MITRE recommends training users to distrust them, because an attacker can use their own certificates to intercept HTTPS traffic1.
  • Check that a site's address begins with "https" rather than "http" before sending sensitive information to it3.
  • Turn on multifactor authentication: with a second factor, an attacker cannot access an account with the stolen password alone6.
  • If a message looks suspicious, click no link and call no number it contains. Look for another way to reach the company or the person, for example their official website5.
  • Report the incident, even if you clicked: the NCSC states that knowing sooner makes it possible to limit the damage, and that users must know in advance how to report, because their compromised device may deprive them of their usual means of communication6.
3Pitfalls1 min

The first pitfall is politeness. A stranger can seem friendly and legitimate, and CISA notes that they may even present credentials to back up their identity3. A badge or a name dropped therefore proves nothing.

The second is urgency. Among the signs of phishing, CISA lists pressing or emotional language, with serious consequences announced if there is no immediate reply5. It adds that spelling mistakes are no longer a reliable sign, because some emails now have perfect grammar5.

The third is the fake address. A sender address can imitate a company's by altering or omitting a few characters3, and CISA gives the example of an address like "amazan.com"5. Sender spoofing can fool humans as well as automated tools4.

The fourth is contact through another channel. A call can go through voice over IP, which makes it easy to falsify the caller's identity3. A displayed number is therefore not enough to confirm who is calling.

Finally, fear of punishment holds back reporting. The NCSC states that users who fear reprisals do not report their mistakes in time, or at all6.

Fact sheet

Identifier
CP-543
Wing
5. Office life and reflexes
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-048
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. MITRE ATT&CK, “Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  3. CISA, “Avoiding Social Engineering and Phishing Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  4. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
  5. CISA, “Recognize and Report Phishing”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
  6. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)

Cite this article

Brain, “Working in a coworking space”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/

BibTeX 
@misc{brain_cp543_en_2026,
  author = {Brain},
  title = {Working in a coworking space},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/coworking-lockers-shared-wifi-screens/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence