Compromised Hotel Wi-Fi Gateways Used to Redirect Guests to Fake Microsoft Login Pages
2026-07-27 05:50:46
Cybersecurity researchers have uncovered a large-scale campaign in which compromised hotel and conference Wi-Fi gateways are being used to redirect guests to attacker-controlled infrastructure, enabling the theft of Microsoft 365 credentials without requiring phishing emails or malware.
According to a report from ReliaQuest, attackers are compromising captive portal gateways and manipulating DNS responses to silently redirect users to counterfeit Microsoft authentication pages. The campaign has been observed across multiple locations in the United States, India, and Saudi Arabia, targeting travelers from industries including finance, healthcare, legal services, energy, and retail.
DNS Poisoning at the Network Gateway
Unlike traditional phishing attacks that rely on malicious emails or deceptive links, this campaign targets the network infrastructure itself.
Researchers found that attackers compromise hotel Wi-Fi gateways by gaining administrative access through exposed management interfaces, such as internet-facing SSH, SNMP, or web administration portals that use weak or reused credentials.
Once inside the gateway, attackers modify the DNS configuration so that every connected device receives forged DNS responses. As a result, users attempting to access legitimate Microsoft services are transparently redirected to attacker-controlled websites that closely mimic official Microsoft login pages.
Because the manipulation occurs at the network level, victims often have no indication that their traffic has been intercepted.
Microsoft 365 Credential Theft
The fraudulent infrastructure is designed to capture Microsoft 365 credentials or abuse Microsoft's device code authentication flow, allowing attackers to obtain OAuth tokens and authenticated sessions without directly stealing passwords.
Researchers identified several domains impersonating Microsoft services, including:
m365-owa[.]com
owa-ms365[.]com
ms365-device[.]com
ms365-live[.]com
These domains were used to host convincing Microsoft login pages and authentication prompts intended to deceive hotel guests into submitting sensitive credentials.
WPAD Abuse Expands the Attack
In approximately one-third of the observed intrusions, attackers also attempted to exploit Web Proxy Auto Discovery (WPAD).
By providing malicious proxy auto-configuration files, attackers could silently route additional web traffic through their own proxy infrastructure, allowing further monitoring of victim activity while making the malicious traffic appear as legitimate HTTPS communication.
This additional layer makes detection significantly more difficult for organizations that rely solely on traditional email or endpoint security controls.
Recommended Defenses
ReliaQuest recommends several measures to reduce exposure when using public Wi-Fi networks:
Use an always-on VPN configured with full-tunnel routing to ensure all traffic and DNS queries pass through trusted corporate infrastructure.
Enable DNS over HTTPS (DoH) or DNS over TLS (DoT) in strict mode to prevent attackers from forging DNS responses.
Disable WPAD where it is not required or restrict automatic proxy configuration to approved internal systems.
Review VPN split-tunneling policies to ensure authentication traffic cannot bypass encrypted tunnels.
Train employees to verify website URLs and TLS certificates before entering credentials on hotel or conference Wi-Fi networks.
Consider disabling Microsoft device code authentication through Conditional Access policies when it is not required.
Threat to Business Travelers
Because a single compromised gateway can affect every device connected to the network, the attack has the potential to impact hundreds of users simultaneously.
Unlike conventional phishing campaigns that target individual victims, this technique allows attackers to intercept authentication attempts from every guest using the compromised wireless network, making hotels and conference venues attractive targets for credential harvesting operations.
Security Takeaway
The campaign demonstrates how attackers are shifting their focus from endpoint compromise to network infrastructure.
Organizations should treat all public Wi-Fi networks as untrusted, require employees to use secure VPN connections, and implement phishing-resistant authentication controls to reduce the risk of credential theft while traveling.
As attackers continue abusing trusted network infrastructure instead of relying solely on phishing emails, organizations must strengthen both user awareness and network security practices to defend against increasingly sophisticated credential theft campaigns.
According to a report from ReliaQuest, attackers are compromising captive portal gateways and manipulating DNS responses to silently redirect users to counterfeit Microsoft authentication pages. The campaign has been observed across multiple locations in the United States, India, and Saudi Arabia, targeting travelers from industries including finance, healthcare, legal services, energy, and retail.
DNS Poisoning at the Network Gateway
Unlike traditional phishing attacks that rely on malicious emails or deceptive links, this campaign targets the network infrastructure itself.
Researchers found that attackers compromise hotel Wi-Fi gateways by gaining administrative access through exposed management interfaces, such as internet-facing SSH, SNMP, or web administration portals that use weak or reused credentials.
Once inside the gateway, attackers modify the DNS configuration so that every connected device receives forged DNS responses. As a result, users attempting to access legitimate Microsoft services are transparently redirected to attacker-controlled websites that closely mimic official Microsoft login pages.
Because the manipulation occurs at the network level, victims often have no indication that their traffic has been intercepted.
Microsoft 365 Credential Theft
The fraudulent infrastructure is designed to capture Microsoft 365 credentials or abuse Microsoft's device code authentication flow, allowing attackers to obtain OAuth tokens and authenticated sessions without directly stealing passwords.
Researchers identified several domains impersonating Microsoft services, including:
m365-owa[.]com
owa-ms365[.]com
ms365-device[.]com
ms365-live[.]com
These domains were used to host convincing Microsoft login pages and authentication prompts intended to deceive hotel guests into submitting sensitive credentials.
WPAD Abuse Expands the Attack
In approximately one-third of the observed intrusions, attackers also attempted to exploit Web Proxy Auto Discovery (WPAD).
By providing malicious proxy auto-configuration files, attackers could silently route additional web traffic through their own proxy infrastructure, allowing further monitoring of victim activity while making the malicious traffic appear as legitimate HTTPS communication.
This additional layer makes detection significantly more difficult for organizations that rely solely on traditional email or endpoint security controls.
Recommended Defenses
ReliaQuest recommends several measures to reduce exposure when using public Wi-Fi networks:
Use an always-on VPN configured with full-tunnel routing to ensure all traffic and DNS queries pass through trusted corporate infrastructure.
Enable DNS over HTTPS (DoH) or DNS over TLS (DoT) in strict mode to prevent attackers from forging DNS responses.
Disable WPAD where it is not required or restrict automatic proxy configuration to approved internal systems.
Review VPN split-tunneling policies to ensure authentication traffic cannot bypass encrypted tunnels.
Train employees to verify website URLs and TLS certificates before entering credentials on hotel or conference Wi-Fi networks.
Consider disabling Microsoft device code authentication through Conditional Access policies when it is not required.
Threat to Business Travelers
Because a single compromised gateway can affect every device connected to the network, the attack has the potential to impact hundreds of users simultaneously.
Unlike conventional phishing campaigns that target individual victims, this technique allows attackers to intercept authentication attempts from every guest using the compromised wireless network, making hotels and conference venues attractive targets for credential harvesting operations.
Security Takeaway
The campaign demonstrates how attackers are shifting their focus from endpoint compromise to network infrastructure.
Organizations should treat all public Wi-Fi networks as untrusted, require employees to use secure VPN connections, and implement phishing-resistant authentication controls to reduce the risk of credential theft while traveling.
As attackers continue abusing trusted network infrastructure instead of relying solely on phishing emails, organizations must strengthen both user awareness and network security practices to defend against increasingly sophisticated credential theft campaigns.