Hotel Wi-Fi DNS Hijack Campaign Steals Microsoft 365 Accounts

Threat actors are hijacking hotel and conference center Wi-Fi gateways to redirect business travelers to fake Microsoft 365 login pages. The campaign, active since at least June 2026, uses DNS manipulation and device-code authentication to bypass multi-factor authentication and seize corporate accounts across multiple sectors.

What Happened: Hotel Wi-Fi DNS Hijack Steals Microsoft 365 Accounts

Security researchers at ReliaQuest uncovered an ongoing campaign where attackers compromise Wi-Fi devices at hotels and conference venues. Once inside, they alter DNS settings to send victims to attacker-controlled login portals that impersonate legitimate Microsoft services.

The campaign is not limited to one region. ReliaQuest identified compromised gateways in multiple U.S. cities as well as locations in India and Saudi Arabia. Consequently, organizations in financial services, professional services, legal, healthcare, energy, and retail have all shown traffic to these hijacked access points. The targeting pattern suggests the threat actors are after traveling employees wherever they connect, not specific companies or industries.

ReliaQuest believes this activity closely resembles the FrostArmada router-based campaigns previously attributed to the Russian espionage group APT28, also known as Fancy Bear or Forest Blizzard. However, the firm has not made a definitive attribution.

Technical Details of the Attack

The attack chain begins with initial access to a hotel or conference Wi-Fi gateway. The exact method remains unclear, but ReliaQuest suggests exposed management interfaces such as SSH, SNMP, or web admin dashboards may be the entry point. Alternatively, the attackers could be exploiting known vulnerabilities in the gateway firmware.

With administrator access, the threat actor modifies the gateway’s DNS resolver configuration. When a connected user tries to reach a legitimate Microsoft 365 login page, the gateway returns the attacker’s IP instead. The victim sees a convincing replica and enters credentials or approves an authentication prompt.

The attackers registered at least four fake domains for this purpose:

• m365-owa[.]com
• owa-ms365[.]com
• ms365-device[.]com
• ms365-live[.]com

In some cases, the attackers leveraged a device-code authentication flow. The victim sees a prompt on a fake Microsoft page and approves it. Moreover, what the user cannot see is that the approval authorizes a session initiated by the attacker. This issues a legitimate OAuth token directly to the attacker’s client, effectively bypassing MFA without stealing credentials or intercepting tokens.

In approximately one-third of investigated cases, the attackers also attempted to abuse Web Proxy Auto-Discovery (WPAD). Windows machines automatically query for a WPAD configuration, and the compromised gateway responded with a malicious PAC file. This theoretically routes traffic from Windows applications, including Chrome, through an attacker-controlled proxy. ReliaQuest could not confirm whether these WPAD attacks succeeded.

Furthermore, using public DNS servers such as Google’s 8.8.8.8 does not prevent this attack. The gateway forges plain-text DNS requests before they ever reach the intended resolver, so the victim receives the attacker’s address regardless of their DNS settings.

Business and Operational Impact

The consequences of this campaign extend far beyond a single compromised account. Stolen Microsoft 365 credentials give attackers access to email, calendar, files, and internal communications. For organizations in regulated sectors, this can mean:

• Data exposure: Sensitive client files, legal documents, and financial records stored in OneDrive or SharePoint
• Business email compromise: Access to executive inboxes for invoice fraud or wire transfer requests
• Lateral movement: Use of compromised credentials to pivot into VPNs, cloud consoles, or on-premises systems
• Reputational damage: Notification obligations and client trust erosion if breach disclosure is required

Since the gateways serve corporate events, a single compromised hotel can expose dozens of organizations simultaneously. The cross-sector targeting makes this a broad threat rather than a narrow espionage operation.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Deploy an always-on, full-tunnel VPN for all remote employees. Encrypted traffic prevents DNS-level redirects from intercepting sessions.
2. Enable encrypted DNS in strict mode. DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) prevents gateway-level forgery.
3. Disable WPAD on all managed Windows endpoints via Group Policy. This removes a common abuse vector.
4. Disable Device Code authentication flow in Microsoft Entra ID if it is not required by your organization.
5. Review Microsoft Entra sign-in logs for device-code authentications from unusual IP ranges or geolocations.
6. Block the known malicious domains at the DNS and proxy layers: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com.

Long-Term Protections

Organizations should also conduct security awareness training focused on travel risks. Employees need to understand that hotel Wi-Fi is an untrusted network and that approving authentication prompts on unfamiliar devices or networks can authorize attacker sessions.

Network security teams should monitor for WPAD queries from external networks and flag any successful PAC file downloads outside the corporate perimeter. Additionally, conditional access policies in Microsoft Entra ID can require compliant devices or trusted locations for sensitive applications.

Bottom line: Hotel Wi-Fi is a public network. Treat it as hostile. Force all traffic through a VPN, disable automatic proxy discovery, and scrutinize any authentication prompt that appears on an untrusted connection.

Incident Summary

Incident:	Hotel Wi-Fi DNS hijack campaign targeting Microsoft 365 accounts
Threat Actor:	Likely APT28 (Fancy Bear / Forest Blizzard) — Russian state-sponsored espionage group
Affected Systems:	Hotel and conference center Wi-Fi gateways; Microsoft 365 accounts
Target Sectors:	Financial services, professional services, legal, healthcare, energy, retail
Geography:	United States, India, Saudi Arabia, and other regions
Disclosure Date:	July 24, 2026
Active Since:	At least June 2026
Patch Status:	N/A — infrastructure compromise, no software patch available
Known Domains:	m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, ms365-live[.]com

References

1. Bill Toulas, “Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts,” BleepingComputer, July 24, 2026, https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/, accessed July 26, 2026.
2. ReliaQuest Threat Research, “Hotel Wi-Fi Gateway DNS Hijacking Campaign Targets Microsoft 365,” ReliaQuest, July 2026.
3. Lawrence Abrams, “Authorities disrupt DNS hijacks used to steal Microsoft 365 logins,” BleepingComputer, FrostArmada coverage, https://www.bleepingcomputer.com/news/security/authorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins/, accessed July 26, 2026.