Is the Coworking WiFi You Are Using Right Now Safe?

$0 to hack. 700 supermarkets. Food destroyed across seven countries.

That is what happened in France last month. Hackers remotely accessed refrigeration control systems, turned freezers up to 122 degrees Fahrenheit, and forced hundreds of stores to throw out their inventory. No one has claimed responsibility. Investigators are still working. The food is gone.

This week, the UK’s National Cyber Security Centre released a separate warning: an AI-powered ransomware attack on critical infrastructure is now “highly likely” by 2028.

I want to talk about what this means for you, specifically if you are a remote worker or digital nomad working from a coworking space in Africa or the Middle East.

Why This Is Your Problem, Not Just Europe’s

The France attack and the UK warning are not isolated stories. They are part of a pattern: attackers are no longer just targeting banks and government systems. They are targeting the infrastructure that runs daily life. Fridges. Power grids. Transport systems. And increasingly, the networks that connect them.

Coworking spaces run on that same category of infrastructure. A shared router. A single broadband connection split across twenty desks. Basic consumer-grade security at best. No network segmentation in most cases. No traffic monitoring. One compromised device on that network, and every device on it is at risk.

I hold a CC ISC2 certification and I am currently studying for my CISSP. I have also spent the last year building Zenvivas, a TravelTech marketplace connecting remote workers and digital nomads with verified workspaces across Africa and the Middle East. Both of those things inform what I am about to tell you.

The threat is real. And most remote workers in Africa are not thinking about it.

What Makes Shared Coworking WiFi Dangerous

When you connect to the shared WiFi at a coworking space, you are joining a network with every other person in that building. Depending on the space, that could be ten people or a hundred. You do not know what devices they are running. You do not know whether any of those devices are already compromised. And in most coworking spaces in Nairobi, Lagos, Accra, or Kigali, the router was configured once and has not been updated since.

The most common attack on shared networks is a man-in-the-middle attack. An attacker positions themselves between your device and the internet, intercepts your traffic, and reads it. This works without any physical access to the router. It works on standard WiFi. It works even on networks that have a password.

A second common attack on shared networks is ARP spoofing, where an attacker maps their device as the gateway on the local network, routing your traffic through their machine before it reaches the internet. Again, no physical access needed.

These are not advanced techniques. Tools that execute both attacks are freely available and require minimal technical skill. Any motivated person in the same coworking space can run them.

The question is not whether this happens in Africa. It is how often, and whether you are a target.

The Six Things I Actually Do Before Connecting at Any Workspace

These are not theoretical recommendations. This is what I do personally before opening my laptop at any coworking space, whether I am in Dubai, Nairobi, or Lagos.

1. Connect through a VPN before doing anything else.
A VPN encrypts your traffic between your device and the VPN server, which means even a man-in-the-middle attacker on the local network cannot read your data. Use a paid, reputable VPN. Free VPNs often log and sell your data, which defeats the purpose entirely. Mullvad, ProtonVPN, and ExpressVPN are the options I trust.

2. Turn off file sharing and AirDrop before connecting.
On Mac: System Settings, General, AirDrop and Handoff. On Windows: Network and Sharing Center. This removes one attack surface immediately.

3. Use your phone hotspot for anything confidential.
If you need to access banking, legal documents, client contracts, or anything sensitive, do not use the shared WiFi. Your mobile data connection is private and encrypted by default. The few extra megabytes are worth it.

4. Check whether HTTPS is active on every site you visit.
Look for the padlock icon in your browser. Do not log into anything on HTTP. If a site asks for your credentials and is not running HTTPS, leave it.

5. Do not accept network certificate warnings.
If your browser throws a certificate warning when you try to visit a site on a shared network, that is a red flag. An attacker may have inserted a fake certificate to intercept your HTTPS traffic. Close the browser, switch to your hotspot, and investigate before continuing.

6. Update your operating system and antivirus before you travel.
Unpatched software is how most endpoint compromises begin. A two-minute update before your trip can close the vulnerabilities that an attacker on a shared network would otherwise exploit.

What This Has to Do With Zenvivas

When Zenvivas vets a coworking space before listing it on the platform, network reliability and backup power are part of what we assess. Not every space passes. The ones that do have demonstrated that they treat the working environment, including its infrastructure, seriously.

This is not a small thing. A workspace that invested in a generator for ZESCO load shedding in Lusaka or a UPS system in Lagos did so because reliability matters to them. Those same operators are more likely to have thought about their network setup than a space that is running everything on a consumer router from 2019.

The platform exists because finding a workspace you can actually trust in an unfamiliar city is hard. Zenvivas is trying to make that easier, and security is part of the brief.

Explore verified workspaces at zenvivas.com.

What the AI Ransomware Warning Actually Means for Remote Workers

The UK NCSC’s warning about AI-powered ransomware is worth understanding beyond the headline. What makes AI-assisted ransomware different from traditional ransomware is speed and targeting. AI tools allow attackers to identify vulnerabilities faster, craft more convincing phishing lures, and automate attacks at a scale that was previously only available to nation-state actors.

For a remote worker, the practical implication is this: phishing attacks are getting harder to detect. The email that looks like it is from your coworking space’s front desk, the fake login page for a tool you use daily, the urgent message from what appears to be a client asking you to click a link, these are being generated and sent at scale, and they are more convincing than anything from three years ago.

The defense is the same as it has always been: verify before you click, use two-factor authentication on every account that matters, and do not enter credentials on a page you reached through an email link. Open a new browser tab and navigate to the site directly.

FAQ: Coworking WiFi Security for Remote Workers in Africa

Is it safe to use coworking WiFi in Africa?
It depends on the space. Basic coworking spaces with consumer-grade routers and no network segmentation present real risks. Reputable coworking hubs with managed network infrastructure are safer. The safest approach in any shared network environment is to connect through a paid VPN and avoid accessing sensitive accounts over the shared connection.

What VPN should I use as a digital nomad in Africa?
Mullvad, ProtonVPN, and ExpressVPN are the three most consistently reliable options across Africa and the Middle East. Avoid free VPNs: they often log your traffic and monetize your data. A paid VPN subscription costs $5 to $10 per month and is non-negotiable infrastructure if you work remotely.

What is a man-in-the-middle attack and how do I avoid it?
A man-in-the-middle attack occurs when an attacker intercepts communication between your device and the internet, typically on a shared network. The attacker reads or alters the data in transit without either party knowing. A VPN prevents this by encrypting traffic end-to-end between your device and the VPN server. Avoiding unencrypted HTTP sites is a secondary protection.

Is using a hotspot safer than coworking WiFi?
Yes, significantly. Your mobile data connection is encrypted by default between your phone and the carrier’s network. An attacker sitting at the same coworking space cannot intercept your hotspot traffic the way they can intercept shared WiFi traffic. Use your hotspot for banking, client contracts, and any login that matters.

What should I look for in a secure coworking space?
Ask whether the space uses enterprise-grade network equipment. Ask whether guest and member networks are segmented. Ask whether there is a firewall in place. The best coworking spaces, including those Zenvivas vets for the platform, can answer these questions directly. A space that cannot answer them has probably not thought about it.

What is the AI ransomware threat in 2026 and should remote workers worry?
The UK National Cyber Security Centre warned in November 2026 that an AI-powered ransomware attack on critical infrastructure is highly likely by 2028. For remote workers, the immediate implication is that phishing attacks are becoming more sophisticated and harder to detect. Two-factor authentication, direct URL navigation instead of clicking email links, and skepticism toward urgent messages from unfamiliar senders are the practical defenses.

QUICK FACTS

News anchor 1: France: 700 supermarkets hit by cyberattack, freezers raised to 122°F, October 2026

News anchor 2: UK NCSC: AI-powered ransomware on critical infrastructure “highly likely” by 2028

Most common coworking attack: Man-in-the-middle on unsegmented shared WiFi

Best defense: Paid VPN: Mullvad, ProtonVPN, or ExpressVPN

For sensitive data: Use your phone hotspot, not shared WiFi

AI phishing risk: Attacks are faster and more convincing at scale in 2026

Find vetted workspaces: zenvivas.com