Hotel Wi-Fi Compromised to Harvest Microsoft 365 Credentials via DNS Poisoning
A sophisticated campaign is poisoning DNS responses on hotel Wi-Fi gateways to redirect guests to attacker-controlled servers, aiming to steal Microsoft 365 credentials.
A widespread campaign is leveraging compromised hotel Wi-Fi gateways to conduct DNS poisoning attacks, silently redirecting all connected guests to attacker-controlled servers. This technique aims to harvest Microsoft 365 credentials from traveling employees by impersonating legitimate login pages.
The attack chain begins with threat actors gaining administrative access to captive portal appliances, likely by exploiting exposed management interfaces such as SSH, SNMP, or web admin consoles using weak or reused credentials. Once access is established, attackers modify the gateway's DNS settings. This manipulation ensures that any domain requested by a guest is resolved to an IP address controlled by the attackers, effectively rerouting all traffic through their infrastructure.
This method, observed across the United States, India, and Saudi Arabia, affects users from various sectors including finance, legal, healthcare, energy, and retail. Reliaquest, whose research brought this campaign to light, notes that the tradecraft bears similarities to techniques previously attributed to APT28 (Fancy Bear/Forest Blizzard), which had targeted SOHO routers with similar DNS alteration tactics. The core of the attack relies on the trust users place in public Wi-Fi networks, turning a single compromised gateway into a central point of interception for all guest traffic.
Once traffic is redirected, users are presented with convincing lookalike Microsoft login pages hosted on attacker-controlled domains like m365-owa.com or owa-ms365.com. These pages are designed to capture credentials or exploit Microsoft's device code flow. By abusing this OAuth flow, attackers can obtain session tokens and multi-factor authentication-satisfied access to Microsoft 365 accounts without needing to directly steal passwords, enabling silent session hijacking.
In approximately one-third of observed cases, attackers also attempted to abuse the Web Proxy Auto Discovery (WPAD) protocol. This allows Windows devices to fetch a malicious proxy auto-configuration file, further routing more traffic through attacker-controlled proxies. This sophisticated redirection can make malicious activity appear as normal HTTPS traffic in logs, making it difficult for organizations to detect without rigorous monitoring of proxy authentication records.
To defend against this threat, organizations are advised to implement always-on VPNs with full tunnel configurations. This ensures that all DNS requests are routed through trusted corporate resolvers before reaching untrusted public networks. Additionally, enforcing strict DNS encryption (DNS over HTTPS or DNS over TLS) on endpoints can prevent opportunistic fallbacks that attackers might exploit.
Further mitigation strategies include disabling WPAD where unnecessary, restricting proxy auto-configuration file retrieval to approved internal hosts, and training employees to meticulously verify URLs and certificates before entering credentials, especially on public networks. For Microsoft 365 environments, blocking the device code authentication flow via Conditional Access policies in Microsoft Entra ID can close off a significant account compromise vector.
The campaign highlights the evolving tactics of threat actors who are increasingly targeting the intersection of travel and corporate security. By exploiting the inherent trust in public Wi-Fi infrastructure, attackers can achieve broad impact with minimal direct interaction with victim devices, underscoring the critical need for robust endpoint and network security measures for remote and traveling employees.