Hotel Wi-Fi DNS Hijacked to Steal Microsoft 365 Accounts
Attackers modify hotel Wi-Fi gateway DNS to redirect guests to fake Microsoft 365 login pages. ReliaQuest links the campaign to APT28, active since June 2025.
Loop The DNS resolver in a hotel Wi-Fi gateway is configured during install and rarely touched afterward. It sits on a flat network shared by every guest, often reachable through a web management interface that hasn’t had a credential rotation since the hardware shipped. That is the layer being modified.
ReliaQuest documented the campaign in a July 24 report: attackers are modifying the DNS forwarder settings on hotel and conference-center Wi-Fi gateways, replacing upstream resolvers so that Microsoft authentication domains return attacker-controlled IP addresses. Guests who attempt to log into Microsoft 365 reach cloned phishing pages instead of legitimate Microsoft infrastructure. Credentials entered there go to the attacker.
The campaign has been running since at least June 2025. Confirmed targeting spans multiple U.S. cities, India, and Saudi Arabia, with affected organizations across financial services, healthcare, legal, energy, and retail — sectors whose employees travel regularly and depend on M365 from public networks.
Initial access
The method used to gain configuration access to the gateways is unconfirmed. ReliaQuest assesses the pattern as consistent with exploitation of weakly protected management interfaces — SSH, SNMP, or web dashboards running at vendor defaults or with stale credentials. Once inside, changing a DNS forwarder entry is a single configuration write. Every guest on that segment is redirected immediately, without any malware delivery to their device.
The device-code variant
A second attack vector documented in this campaign does not require control of the gateway at all. The attacker initiates a Microsoft OAuth device-code authentication flow from their own machine. The resulting user-facing prompt — a code and a request to approve access — is then surfaced to the victim, either through the rogue captive portal or a follow-up phishing email.
The victim sees a standard Microsoft interface asking them to confirm an authentication code. What they are approving is the attacker’s session. A valid OAuth token is issued and persists after the victim leaves the property. No credentials are directly collected.
Device-code authentication was built for devices without browsers — printers, appliances, embedded hardware. It is not a standard interactive login method. That it is enabled by default for a general employee population is a configuration choice with a known exploitation surface; this campaign is not its first use.
Malicious domains observed in this campaign: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, ms365-live[.]com.
Attribution
ReliaQuest assesses the activity as consistent with prior router-based operations attributed to APT28 — also tracked as Forest Blizzard and Fancy Bear — a Russian military intelligence group with a documented history of targeting credentials from traveling government and business employees. Attribution to APT28 is ReliaQuest’s assessment; it has not been independently confirmed.
Three controls, in priority order
Restrict device-code authentication in Microsoft Entra ID. In Conditional Access, locate the device-code flow policy and scope it to the specific applications and user groups with a documented operational need. For most organizations that list is short. The credential-less OAuth token theft variant does not survive this restriction. This is the control that can be applied today without changes to travel policy or endpoint tooling.
Full-tunnel VPN with encrypted DNS in strict mode on hotel and conference networks. DNS resolution happens inside the tunnel before the hotel gateway is involved. A modified forwarder at the gateway is irrelevant if the resolver is not the gateway’s.
Disable WPAD. Web Proxy Auto-Discovery allows the local network to push proxy configuration to connected endpoints. It is not required for business travel and expands the attack surface on shared networks.
The first item is the immediate action. Review Entra ID’s Authentication Methods and Conditional Access policies; if device-code flow is open to the general employee population, close it.
For prior coverage of device-code phishing infrastructure: M365 Device-Code Phishing and STORM-2372 and ARToken and EvilTokens M365 Device-Code Phishing Kit (Talos). For the broader MFA-bypass phishing-kit landscape: Kratos Phishing Kit Dismantled.
Found this useful? Share it.
