Ethical Hacking News
Hackers have been hijacking hotel Wi-Fi gateways to steal Microsoft 365 credentials from unsuspecting corporate travelers. This attack relies on trust, using DNS poisoning to redirect users to fake login pages. To prevent this attack, organizations should force their devices onto an always-on VPN with full-tunnel routing and disable WPAD where nobody needs it. With the threat landscape evolving rapidly, cybersecurity awareness and robust security measures are crucial for protecting against sophisticated attacks like this one.
Hackers hijacked hotel Wi-Fi gateways to steal Microsoft 365 credentials from unsuspecting corporate travelers. The attack relied on exploiting weak admin credentials and DNS manipulation to trick devices into submitting credentials. The threat relies on trust, as devices assume the DNS resolver is trustworthy. To avoid this attack, full-tunnel VPNs with encrypted DNS or strict mode should be used. Additionally, disabling WPAD, blocking Microsoft's device-code flow, and training users to verify certificates are recommended measures.
In a recent incident, hackers have been hijacking hotel Wi-Fi gateways to steal Microsoft 365 credentials from unsuspecting corporate travelers. This malicious attack, which has been ongoing since at least June 2026, highlights the growing threat of sophisticated cyber attacks on public Wi-Fi networks.
According to a report published by ReliaQuest, a threat research team, hackers have compromised hotel Wi-Fi gateways and redirected users to fake Microsoft login pages, allowing them to steal credentials. The mechanism is simple once you see it: these gateways handle DNS for every device that connects, so whoever controls the gateway controls where your traffic actually goes.
The attackers exploited weak or reused admin credentials on internet-facing management interfaces, such as exposed SSH or web consoles, to gain initial access into devices. Once inside, they pointed DNS toward domains built to look like Microsoft's login pages, including m365-owa.com and ms365-live.com.
This attack relies on trust, as a device joining a network assumes the DNS resolver it's handed is telling the truth. However, this trust gets abused in a way that dodges the DNS protections people already have. Switching to a hardcoded resolver like 8.8.8.8 doesn't save you, because the query still leaves the laptop unencrypted and the gateway can rewrite the answer before it ever reaches Google's server.
Encrypted DNS tools help only if they run in strict mode; the default "opportunistic" mode quietly falls back to plaintext the moment encryption fails, and that fallback is exactly what gets hijacked. To avoid this attack, a full-tunnel VPN routes all DNS through the corporate tunnel before the gateway can touch the request, or encrypted DNS in strict mode (DNS over HTTPS or DNS over TLS with plaintext fallback disabled) ensures the gateway can't forge a response.
In some cases, attackers also attempted to abuse Windows' automatic proxy discovery feature, known as WPAD. If successful, they could intercept traffic from browsers, authentication services, and enterprise apps. In a smaller number of cases, attackers skipped credential theft entirely and went after Microsoft's device-code sign-in flow instead, tricking users into approving a login they didn’t realize belonged to someone else.
The tradecraft echoes a Russian-linked operation called FrostArmada, which hit home routers the same way earlier this year. Researchers tie both to the group known as APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM).
To prevent this attack, ReliaQuest suggests that corporate devices should be forced onto an always-on VPN with full-tunnel routing, so DNS never touches the hotel network at all. Additionally, disable WPAD where nobody needs it, block Microsoft's device-code flow at the identity provider unless someone has a real reason to keep it, and train people to check the certificate before they type a password on airport or hotel Wi-Fi.
This attack highlights the importance of prioritizing cybersecurity awareness and implementing robust security measures for corporate travelers. As the threat landscape continues to evolve, it's essential for organizations to stay vigilant and adapt their security protocols to protect against sophisticated attacks like this one.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Hijacking-Hotel-Wi-Fi-to-Steal-Microsoft-365-Credentials-A-Threat-to-Corporate-Travelers-ehn.shtml
https://securityaffairs.com/196017/security/hackers-hijack-hotel-wi-fi-to-steal-microsoft-365-credentials.html
Published: Sun Jul 26 09:39:12 2026 by llama3.2 3B Q4_K_M
