Cyberpediaby Brain
ENDEFR

Evil Maid attack on a hotel laptop

How someone left alone for a few minutes with a laptop in a hotel room can compromise it, and what to do about it.

In 30 seconds

Where it happens
A laptop left unattended (hotel room, meeting room, car), even when off or locked.
What the attacker wants
To place code that runs before the system, to steal data, passwords or the disk encryption key12.
The reflex
Do not leave the device alone, shut it down completely before walking away and use a startup PIN if the IT department offers one2.
If it has already happened
If the device asks for a recovery key for no known reason, tell the IT department before using it again.

What it is

The name "Evil Maid" describes a simple situation: a laptop is left alone in a hotel room, and someone gets at it for a few minutes. The device is off or locked, and nothing seems to have moved. Yet a change made before Windows starts escapes the protections that the system applies only once it is running1.

Boot malware, the "bootkits", can in fact start before Windows, bypass system security and stay hidden1. This article explains the principle, what you see on screen and the reflexes that reduce the risk. The sources cited here describe no specific hotel case: the dated cases below are real attacks of the same type (modification of the boot process or of the firmware, plugged-in hardware), not hotel scenes.

Straight answers

Can a device that is switched off really be attacked?

Yes, if its boot process is not protected. An attacker with raw access to the boot disk can overwrite the area holding the loader and redirect execution to their own code3. On a UEFI device, they can create or modify files on the EFI system partition to run malicious code at kernel level3.

What is the attacker trying to get?

Rootkits, of which bootkits are one kind, often come with other malware able to bypass local logins, record passwords and keystrokes, transfer private files and capture cryptographic data1.

Is disk encryption enough?

It protects the data on a lost or stolen device, including against a software attack tool or moving the disk to another machine4. Microsoft states that BitLocker protects by default against a bootkit being installed by someone with physical access: the TPM observes the modification and the key is not released2. The same document notes that the "TPM only" mode is more convenient but less secure than the options that require a second factor2.

What is a TPM?

It is a chip designed to provide basic security functions, mainly around encryption keys. BitLocker binds its keys to it to check that the device was not modified while the system was offline2.

1Inside the attacker's head1 min

The attacker has little time and physical access. Microsoft distinguishes two profiles. The first is the opportunistic attacker: they use no destructive method and no sophisticated analysis tool, and the shape of the device (no external port capable of direct memory access, no visible screw, soldered memory) limits their options2. The second has skills and prolonged access: they open the case, solder and use specialised hardware or software2. On some systems, bypassing the "TPM only" mode may require opening the case and soldering, at a reasonable cost; bypassing a TPM protected by a PIN costs more and forces the attacker to guess the PIN2.

Several routes exist. The first modifies the boot sector or the EFI partition so that hostile code runs before the system3. The second targets the firmware (BIOS or UEFI): means exist to overwrite it, which can give sophisticated attackers persistence that is hard to detect5. The third adds hardware. MITRE notes that many penetration-testing teams use accessories able to inject keystrokes or read kernel memory through direct memory access (DMA), and that public references of use by real attackers are rare6.

2What you see on screen1 min

Nothing specific is described. The sources cited here describe no particular fake screen. They do say, however, that a rootkit that starts before the system can hide completely1. The BitLocker PIN entry screen is itself a step that comes before Windows4, so at the same place where malicious boot code would run.

One landmark exists all the same: with the "TPM only" mode, if BitLocker detects a change in the BIOS or UEFI configuration, in critical boot files or in the boot configuration, it switches to recovery mode and asks for the recovery password2. An unexpected recovery screen therefore deserves a report. So does an unknown accessory plugged into the device, since such an accessory can inject keystrokes6.

3Under the hoodIT teams2 min

At startup, the firmware first finds the system loader. Without Secure Boot, the PC runs the one on the disk and cannot know whether it belongs to a trusted system or to a rootkit1. With Secure Boot, the firmware checks the loader's signature before launching it1.

Bootkits replace or modify this loader. On a classic BIOS, they touch the Master Boot Record (MBR) or the Volume Boot Record (VBR); on a UEFI, they create or modify files on the EFI partition3. Firmware rootkits overwrite the BIOS or another hardware firmware to start before Windows1. NIST ranks unauthorised modification of the BIOS among the significant threats, because of the BIOS's privileged position in the PC architecture7.

The defences form a chain. Secure Boot launches only trusted loaders, Trusted Boot then checks each boot component, and Measured Boot logs the startup so that a trusted server can assess the state of the PC1. BitLocker relies on the TPM's measurement: an unauthorised EFI firmware, boot application or loader can neither run nor obtain the key2. If the attacker modifies the boot configuration database to point to a decoy system, BitLocker cryptographically checks that the recipient of the key is the right system2.

The startup PIN adds a second factor. BitLocker loads keys into memory only once pre-boot authentication is complete, and the TPM limits repeated attempts to counter brute force2. The PIN also helps against attacks through DMA ports and memory remanence2.

4Case filesReal cases1 min

The sources cited here give no dated hotel case. They cite real attacks of the same nature, with the date of the reference shown on the page.

Hacking Team, 2015: a rootkit in the BIOS

MITRE cites a UEFI BIOS rootkit developed by the company Hacking Team to keep remote access software on certain targeted systems5. The associated reference is an article dated 13 July 20155.

LoJax: a UEFI rootkit seen in the wild (reference from September 2018)

LoJax is a UEFI BIOS rootkit deployed to keep remote access software on certain targeted systems5. MITRE's reference is an ESET article from September 2018 titled "LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group"5.

DarkVishnya: hardware plugged in on site (reference from December 2018)

DarkVishnya physically plugged a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops into an organisation's environment to gain access to its local network6. The reference is an analysis dated 6 December 2018 on banks attacked through a direct connection to the local network6.

WhisperGate, January 2022: a hijacked boot loader

WhisperGate overwrites the MBR with a loader component that wipes hard drives and displays a fake ransom demand at startup3. Most of MITRE's references on this case date from January 2022, one from February 20223.

5The right reflexes1 min
  • Do not leave the device alone.
  • Shut it down completely or put it into hibernation before walking away. In simple sleep mode, programs and documents stay in memory and the PIN is not asked for again on wake-up; in hibernation, the disk is locked2.
  • If your organisation allows it, use encryption with a startup PIN. The "TPM only" mode is the default and targets the opportunistic attacker; against an attacker with skills and time, Microsoft recommends a TPM with PIN, sleep disabled and a shutdown or hibernation before leaving the device2.
  • Keep Secure Boot on: turning it off does not protect against bootkits1. Microsoft also recommends requiring a password to change BIOS settings2.
  • On your return, if the device behaves differently (recovery prompt, unknown accessory), report it to the IT department before reconnecting it. A bootkit sits below the system and can make a full clean-up difficult3.

Fact sheet

Identifier
CP-089
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-056
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. Microsoft, “Secure the Windows boot process”. https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process (accessed 3 November 2026)
  2. Microsoft, “BitLocker countermeasures”. https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures (accessed 3 November 2026)
  3. MITRE ATT&CK, “Pre-OS Boot: Bootkit, Sub-technique T1542.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1542/003/ (accessed 3 November 2026)
  4. Microsoft, “BitLocker Overview”. https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Pre-OS Boot: System Firmware, Sub-technique T1542.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1542/001/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  7. NIST, “SP 800-147B, BIOS Protection Guidelines for Servers”, 28 August 2014. https://csrc.nist.gov/pubs/sp/800/147/b/final (accessed 3 November 2026)

Cite this article

Brain, “Evil Maid attack on a hotel laptop”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/

BibTeX 
@misc{brain_cp089_en_2026,
  author = {Brain},
  title = {Evil Maid attack on a hotel laptop},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/evil-maid-laptop-hotel-attack/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence