Hotel Wi-Fi DNS Hijacked to Serve Fake M365 Pages
Attackers are reconfiguring DNS on hotel Wi-Fi devices to redirect guests to fake Microsoft 365 login pages and harvest corporate credentials.
Loop The DNS entry in a hotel router is a configuration field most guests never see. BleepingComputer reported Thursday that attackers are modifying those entries — changing DNS settings on Wi-Fi devices at hotels and conference centers to redirect guests who navigate to Microsoft 365 login URLs toward attacker-controlled clones instead.
How the redirect works
DNS resolution happens before any application-layer connection. When a guest joins hotel Wi-Fi and browses to a Microsoft 365 sign-in address, the hostname lookup goes to whatever resolver the router advertises over DHCP. If that resolver has been tampered with to return a malicious IP for Microsoft’s login hostnames, the browser renders the attacker’s page — the expected URL visible in the address bar — before the user sees anything anomalous.
The compromise is not in Microsoft 365 itself. It’s in the network device providing DNS to every guest on that segment. Once an attacker controls the DNS configuration, all hostname resolution for connected users runs through whatever the attacker says — until someone audits the router.
Corporate travelers authenticating to work accounts are the target. A Microsoft 365 credential set unlocks email, SharePoint, Teams, and OneDrive access. That profile is worth the effort of compromising a hotel router to collect.
Why hotel infrastructure is reachable
Hotel and conference center Wi-Fi devices are not uniformly maintained. The range runs from enterprise-managed systems with current firmware to consumer-grade access points running default credentials and firmware that hasn’t been updated since installation. Exposed management interfaces, unchanged default passwords, and unpatched vulnerabilities against specific device models are all documented attack paths into the DNS configuration — a single field that, once changed, affects every guest lookup on the network.
The setting requires no physical access to the device after the initial compromise. A DNS change applied remotely persists until it’s noticed and reverted.
The certificate check that isn’t enough
Checking for the HTTPS padlock does not protect against this. A valid TLS certificate issued to a lookalike domain — a typosquatted variant that resembles login.microsoftonline.com — produces the same padlock a legitimate domain does. The padlock indicates the connection is encrypted to wherever the certificate says; it does not indicate that “wherever” is Microsoft’s actual infrastructure.
What helps: phishing-resistant authenticators. Hardware-backed FIDO2 keys bind the authentication exchange to the specific domain the credential was registered against. Credentials issued to login.microsoftonline.com cannot be replayed against any other domain — a cloned login page collecting a passkey assertion gets nothing usable. If corporate travelers authenticate to Microsoft 365 without FIDO2, DNS hijacking at a trusted network device is a viable credential-collection path, and hotel Wi-Fi is not the only venue where that device is exposed.
This attack fits the same credential-interception pattern CTM360 documented earlier this week for insurance-sector phishing — the mechanism differs, but the structural problem is the same: authentication that relies on network-layer trust the attacker has already compromised.
One actionable check
Verify the full domain name in the address bar before entering Microsoft 365 credentials on any unfamiliar network. The legitimate entry point is login.microsoftonline.com. A domain that resembles it is not it. On a hotel network, the DNS resolver providing that answer may not be reliable — that check has to be deliberate.
Source: Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts — BleepingComputer, July 24, 2026.
Found this useful? Share it.
