Hotel Wi-Fi DNS Hijacks Target M365

Travelers relying on public infrastructure at hotels and conference centers are facing a new wave of credential theft targeting business accounts. Reports indicate that malicious actors have successfully gained administrative control over Wi-Fi gateways to reroute traffic away from legitimate services toward fraudulent login portals designed to capture session data.

Compromised Gateways Across Regions

The campaign, which has been active since at least June, does not appear to prioritize any single industry. Investigations by the cybersecurity firm ReliaQuest revealed that affected Wi-Fi gateways are located in multiple cities across the U.S., as well as sites in India and Saudi Arabia. The breadth of the infrastructure compromise suggests a focus on the transient nature of high-value targets, specifically corporate employees attending professional events.

While the exact method used to secure initial entry into the gateway hardware remains under investigation, experts suspect attackers may be leveraging exposed management interfaces or known vulnerabilities in device firmware. Once administrative access is established, the threat actors modify the gateway's DNS settings to intercept traffic.

Bypassing Traditional MFA Protections

The attack sequence goes beyond standard credential harvesting. By manipulating the authentication flow, attackers are targeting the device-code authentication process to gain access to accounts without ever needing to intercept a password or a traditional MFA token.

What the user can't see is that approving the prompt authorizes a session initiated by the attacker.

— ReliaQuest, cybersecurity company

By tricking the user into authorizing a session, the attacker forces a legitimate OAuth token to be issued directly to their own infrastructure. This method effectively neutralizes many common multi-factor authentication implementations. In approximately one-third of observed instances, the attackers also attempted to abuse the Web Proxy Auto-Discovery (WPAD) protocol, potentially routing traffic through an attacker-controlled proxy server.

Observed Infrastructure and Tactics

• The campaign has been active since at least June.
• At least four domains have been identified as hosting fake Microsoft login portals.
• Researchers observed attempted abuse of WPAD in roughly one-third of investigated cases.

Securing Connections for Remote Work

The technical nature of these hijacks means that relying on standard public DNS providers does not offer immunity, as the compromised gateway intercepts the request before it leaves the local network. For organizations with traveling staff, this Test every layer before attackers do approach to network security is increasingly necessary. Protecting against this vector requires a shift in how devices handle network traffic, specifically through the use of always-on VPNs that utilize full-tunneling and encrypted DNS in strict mode. By proactively disabling unused features like Device Code authentication in Microsoft Entra ID and auditing for WPAD usage, security teams may be able to reduce the attack surface available to actors exploiting these local network choke points.