Hotel Wi-Fi Compromised to Harvest Microsoft 365 Credentials via DNS Poisoning
A sophisticated campaign is poisoning DNS responses on hotel Wi-Fi gateways to redirect guests to attacker-controlled servers, aiming to steal Microsoft 365 credentials.
A widespread campaign is leveraging compromised hotel Wi-Fi gateways to conduct DNS poisoning attacks, silently redirecting all connected guests to attacker-controlled servers. This technique aims to harvest Microsoft 365 credentials from traveling employees by impersonating legitimate login pages.
The attack chain begins with threat actors gaining administrative access to captive portal appliances, likely by exploiting exposed management interfaces such as SSH, SNMP, or web admin consoles using weak or reused credentials. Once access is established, attackers modify the gateway's DNS settings. This manipulation ensures that any domain requested by a guest is resolved to an IP address controlled by the attackers, effectively rerouting all traffic through their infrastructure.
This method, observed across the United States, India, and Saudi Arabia, affects users from various sectors including finance, legal, healthcare, energy, and retail. Reliaquest, whose research brought this campaign to light, notes that the tradecraft bears similarities to techniques previously attributed to APT28 (Fancy Bear/Forest Blizzard), which had targeted SOHO routers with similar DNS alteration tactics. The core of the attack relies on the trust users place in public Wi-Fi networks, turning a single compromised gateway into a central point of interception for all guest traffic.
Once traffic is redirected, users are presented with convincing lookalike Microsoft login pages hosted on attacker-controlled domains like m365-owa.com or owa-ms365.com. These pages are designed to capture credentials or exploit Microsoft's device code flow. By abusing this OAuth flow, attackers can obtain session tokens and multi-factor authentication-satisfied access to Microsoft 365 accounts without needing to directly steal passwords, enabling silent session hijacking.
In approximately one-third of observed cases, attackers also attempted to abuse the Web Proxy Auto Discovery (WPAD) protocol. This allows Windows devices to fetch a malicious proxy auto-configuration file, further routing more traffic through attacker-controlled proxies. This sophisticated redirection can make malicious activity appear as normal HTTPS traffic in logs, making it difficult for organizations to detect without rigorous monitoring of proxy authentication records.
To defend against this threat, organizations are advised to implement always-on VPNs with full tunnel configurations. This ensures that all DNS requests are routed through trusted corporate resolvers before reaching untrusted public networks. Additionally, enforcing strict DNS encryption (DNS over HTTPS or DNS over TLS) on endpoints can prevent opportunistic fallbacks that attackers might exploit.
Further mitigation strategies include disabling WPAD where unnecessary, restricting proxy auto-configuration file retrieval to approved internal hosts, and training employees to meticulously verify URLs and certificates before entering credentials, especially on public networks. For Microsoft 365 environments, blocking the device code authentication flow via Conditional Access policies in Microsoft Entra ID can close off a significant account compromise vector.
The campaign highlights the evolving tactics of threat actors who are increasingly targeting the intersection of travel and corporate security. By exploiting the inherent trust in public Wi-Fi infrastructure, attackers can achieve broad impact with minimal direct interaction with victim devices, underscoring the critical need for robust endpoint and network security measures for remote and traveling employees.
This new reporting indicates the DNS poisoning campaign targeting hotel Wi-Fi networks is not limited to Microsoft 365 credentials, but is a broader effort to harvest a wide range of corporate login credentials. The identified compromised routers were found globally, including in the US, India, and Saudi Arabia, and the attack vector is believed to involve exploiting exposed management interfaces or weak credentials. The campaign's tradecraft bears similarities to those attributed to APT28, also known as Fancy Bear.
This new reporting details a sophisticated attack chain that bypasses multi-factor authentication by abusing Microsoft's OAuth device-code flow. Attackers redirect users to a fake Microsoft login page, and when the user approves a prompt, it authorizes a legitimate OAuth token to the attacker's client, effectively hijacking the session without stealing credentials or intercepting tokens.
This new reporting indicates the threat actor is actively compromising Wi-Fi gateways in various shared venues like hotels and conference centers across the US, India, and Saudi Arabia. While the core technique of DNS poisoning to harvest Microsoft 365 credentials remains the same, the actor's infrastructure and specific targeting of captive portal appliances differ from previously documented FrostArmada activity, suggesting a potentially less sophisticated or distinct actor.
Microsoft has now attributed this campaign to Storm-2945, a sub-cluster of the Russian espionage group Midnight Blizzard, believed to be linked to Russia's Foreign Intelligence Service (SVR). The attackers are manipulating traffic on compromised hotel networks to redirect victims to fake Microsoft login pages or fraudulent update screens to deploy malware, including the CornFlake remote access trojan and ChocoShell information stealer. The campaign, first observed in May, has also shown signs of expanding to target Android users.