They’re Hacking Hotel Wi-Fi to Steal Microsoft 365 Accounts

Compromising Wi-Fi gateways in hotels and conference centers to hijack Microsoft 365 accounts belonging to traveling users — that’s the new campaign that has been active since early June 2026. No malicious email, no malware on the endpoint: a network-level DNS poisoning attack is enough to redirect users to fake Microsoft sign-in pages. Here’s what we know about this campaign.

One Compromised Gateway, All Guests Exposed

In a new report, ReliaQuest describes a new attack campaign based on the compromise of captive portals, mainly in the hospitality sector. The researchers mention cases in several U.S. cities, as well as in India and Saudi Arabia. No matter who you work for or what industry you’re in, this campaign targets a very specific profile: the traveling employee or executive.

What is being targeted is the captive portal. This system manages guest Internet access and distributes, via DHCP, the DNS server address to use to reach the Web. That means if you can take control of name resolution, you can influence the network traffic of every connected device without ever touching the devices directly. "Every employee connecting to this network is exposed", the report says. No phishing link, no malicious attachment, and no device compromise. It’s transparent.

Without certainty, the researchers believe the initial access may rely on exposed administration interfaces on the Internet (SSH, SNMP, web consoles) combined with weak or reused credentials. This would allow attackers to take control of the captive portal and divert traffic through DNS response poisoning (DNS poisoning).

At least 4 domains registered by the attackers were used to present users with a Microsoft-branded login page: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com and ms365-live[.]com. Malicious sites hosted on IP addresses 31.57.243[.]154 and 104.194.159[.]150. Once the user signs in on that page and enters their credentials, those credentials actually end up in the hands of the attackers.

But who is behind this malicious campaign? The modus operandi appears close to that of APT28, a Russian hacking group. ReliaQuest points to overlaps with FrostArmada, a campaign targeting SOHO routers dismantled in April 2026 and attributed to APT28, also known as Fancy Bear and Forest Blizzard. In that previous campaign, DNS poisoning at the gateway level was already in play. However, this remains an assumption.

WPAD and Device Code, Two Techniques Missing from FrostArmada

The researchers’ investigations identified two secondary techniques that were not seen in FrostArmada.

• Abusing WPAD. In about 1 out of 3 cases, the attackers attempted to hijack automatic proxy discovery to route Windows application traffic through their own server.
• Hijacking the device code flow. Less common, but more effective: the victim approves what looks like a legitimate authorization request and Microsoft issues valid OAuth tokens to the attacker’s client. Access to Microsoft 365 with MFA already satisfied, with no password stolen at all, as with the DEBULL phishing kit documented in late June 2026. This also echoes the Kali365 campaign: device code attacks are clearly gaining traction with threat actors.

On ms365-device[.]com, the researchers also spotted an operator-side administration panel, still active on July 23, 2026. Enough to suggest that the campaign is not over.

Why Pointing to 8.8.8.8 Won’t Protect You

Forcing a public resolver such as Google’s on your PC does not provide any protection here: the query leaves the endpoint in cleartext and the gateway can read it, tamper with it, and redirect it. The same is true if your machine falls back to plain DNS while you are using encrypted DNS (DoT, DoH).

Against this kind of threat, the solution has a name: VPN. If the tunnel is active in full-tunnel mode, all traffic will pass through the encrypted tunnel, which helps protect against DNS poisoning attempts (the traffic is protected). Using DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH) is also a good option, but only in strict mode: fallback to the classic method (plain DNS) must not be allowed.

The best approach is still to avoid this kind of network whenever possible. Prefer using your smartphone as a hotspot when you can. In addition, you can also disable WPAD via GPO where it is not needed and block the device code flow through a conditional access policy.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio