Hotel Wi-Fi phishing attack targets Microsoft logins
Hackers are quietly compromising Wi-Fi gateways at hotels and conference centers across the United States, using tampered equipment to redirect business travelers to counterfeit Microsoft 365 login pages, according to cybersecurity researchers at ReliaQuest.
The campaign has been active since at least June and has hit organizations in financial services, professional services, legal, health care, energy and retail, the company said. The wide range of affected sectors suggests the attackers are casting a net for traveling employees rather than going after any single industry.
Here's how the scheme works. A Wi-Fi gateway is the piece of equipment that controls how every connected device reaches the internet. Once hackers break into one, they can tamper with its Domain Name System settings. DNS, in simple terms, acts as the internet's address book, translating a website name into the numerical address a computer needs to load a page. When a traveler tries to open the real Microsoft 365 login, the compromised gateway can send the browser to a fake site instead. The hotel's network name still appears in a phone or laptop's Wi-Fi settings. Other websites continue to load normally. The attack only shows itself when the user is asked to type in a password.
The researchers have not confirmed exactly how the attackers first broke in. Possible entry points include administrative tools left exposed to the internet, weak passwords on management dashboards and unpatched software on older appliances. A single compromised gateway can affect everyone who connects during a multi-day conference.
ReliaQuest identified at least four domains registered for the fake Microsoft portals. The addresses include familiar Microsoft terms, making them easy to miss for someone rushing between meetings. The fraudulent pages are designed to capture Microsoft 365 email addresses and passwords, opening the door to business email, private documents and company cloud services. Attackers who gain control of a work account can also impersonate the employee, creating opportunities for payment fraud, internal phishing and follow-on attacks on coworkers and clients.
In a more sophisticated version of the scheme, travelers encounter what looks like a standard Microsoft sign-in prompt asking them to approve a device or enter a code. In reality, the attacker has already started the authentication process on the other end. When the user approves the request, Microsoft issues a legitimate OAuth token to the hacker, granting account access without the need to steal a password or intercept a one-time code. Because the user completes the approval themselves, the technique can sidestep multifactor authentication.
ReliaQuest also found that in roughly one-third of incidents, the attackers tried to abuse a Windows networking feature called Web Proxy Auto-Discovery, or WPAD, to push malicious proxy settings onto devices. The researchers were unable to confirm whether those attempts succeeded, but the activity suggests the hackers may be looking to expand their reach beyond stolen Microsoft credentials.
Travelers and security teams do have some options. ReliaQuest notes that switching to a public DNS service such as Google's 8.8.8.8 will not by itself block this campaign, because the compromised gateway can intercept and forge DNS requests before they leave the hotel network. Encrypted DNS configured in strict mode offers stronger protection, and a full-tunnel VPN that covers all traffic, not just selected apps, can keep internet activity from being read or redirected on an untrusted network. A personal cellular hotspot is another reliable alternative for handling sensitive email and logins.
Before entering credentials, travelers are urged to read the full web address in the browser bar, rely on saved bookmarks or the official Microsoft 365 application rather than prompts that appear after connecting, and pause on any unexpected device approval request. Installing operating system and browser updates before a trip can close the kinds of vulnerabilities attackers exploit alongside network-based schemes, and reputable antivirus software with web protection turned on can add an extra layer of defense.
For organizations, ReliaQuest recommends disabling Microsoft Entra ID device code authentication when it is not needed, reviewing login records for unusual locations and unfamiliar devices, disabling WPAD where business systems do not require it and investigating any unexpected proxy configuration activity on Windows machines.
The broader lesson, according to researchers, is that a hotel Wi-Fi network can appear completely normal while quietly steering users toward a fake login page. The network name may match the property and the sign-in screen may look polished, which makes the attack difficult to detect. The strongest warning sign is often an unexpected request for a work password or an unfamiliar device approval prompt, particularly when a traveler is in a hurry between meetings. Stopping to verify those prompts through a company's IT department, rather than simply approving them, can prevent an attacker from walking away with a valid session token and everything it unlocks.