Thought Leadership
Attackers alter DNS settings in hotel Wi-Fi networks to redirect users to fake Microsoft 365 pages and steal credentials.
Security researchers at ReliaQuest have uncovered an attack series ongoing since at least June 2026. Attackers alter the DNS settings of Wi-Fi gateways in hotels and conference centers. Locations in several US cities as well as in India and Saudi Arabia are affected. The goal of the campaign is the theft of credentials for Microsoft 365 accounts belonging to business travelers from sectors such as finance, legal services, healthcare, and retail. ReliaQuest explained its observations as follows:
“We observed traffic to these compromised gateways from organizations in a range of industries, including financial services, professional services, legal, health care, energy, and retail- confirming this isn’t sector-specific targeting, but a campaign that highly likely goes after traveling employees wherever they connect.”
ReliaQuest
Traffic Redirection and MFA Bypassing to Microsoft 365
After gaining administrator privileges on the Wi-Fi devices, the attackers modify their DNS configuration. Requests to legitimate Microsoft services are redirected to domains controlled by the attackers, such as m365-owa[.]com or ms365-live[.]com. On these fake login pages, users are tricked into entering their credentials or authorizing access via the device code flow. During this procedure, a fake page prompts the user to confirm a login. ReliaQuest noted: “What the user can’t see is that approving the prompt authorizes a session initiated by the attacker.”
Confirmation issues a valid OAuth token to the attacker. This approach allows session hijacking and bypasses multi-factor authentication (MFA) without needing to intercept credentials. In roughly one-third of the investigated cases, the attackers also attempted to abuse the Web Proxy Auto-Discovery (WPAD) protocol.
Campaign Attribution and Protective Measures
ReliaQuest attributes the attack methods to the group known as APT28, Fancy Bear, or Forest Blizzard, which previously acted with similar patterns under the designation FrostArmada. The use of public DNS servers such as 8.8.8.8 does not protect against this manipulation, as the compromised gateway intercepts unencrypted requests before they reach the intended resolver.
To defend against these attacks, the security firm recommends the continuous use of full-tunnel VPN connections and encrypted DNS in strict mode. Additionally, disabling the WPAD protocol and turning off the device code authentication flow in Microsoft Entra ID when not strictly required is advised.
(red)
