A widespread campaign is turning free Wi-Fi at hotels and conference centers into an identity theft layer for business travelers, according to a July 23 Threat Spotlight from security operations firm ReliaQuest. The technique requires no phishing email and no compromised laptop. Attackers who gain administrative control of a single hospitality Wi-Fi gateway can poison DNS for every guest connected to it, quietly rerouting Microsoft 365 logins to attacker controlled infrastructure.
The gateway is the target, not the guest
ReliaQuest says the campaign has been active since at least June 2026 and has compromised captive portal appliances, the login gateways travelers click through before getting online, at hotels, conference centers, airports, co-working spaces, universities, and healthcare facilities. Most of the affected venues are in the United States, with additional infrastructure identified in India and Saudi Arabia.
The initial foothold is unglamorous: attackers reach these appliances through exposed management interfaces, SSH, SNMP, or web consoles, protected by weak or default credentials. Once inside, they do not touch individual laptops. They change the gateway’s own DNS configuration. Because the gateway resolves DNS for every device on that network, a single compromised box can redirect an entire hotel floor or conference hall.
Three layers of redirection
According to ReliaQuest, the campaign combines three techniques:
DNS poisoning is the primary method. Poisoned gateways send guests to four lookalike domains ReliaQuest identified, including m365-owa[.]com and ms365-live[.]com, hosted on a small set of attacker controlled IP addresses. These pages impersonate Microsoft 365 and Outlook Web Access login screens closely enough to catch a distracted traveler.
WPAD abuse shows up in roughly a third of cases. Attackers exploit Web Proxy Auto-Discovery to push a malicious proxy configuration to Windows devices, routing application traffic through infrastructure they control even when a user’s DNS settings look clean.
Device-code flow abuse is the most consequential layer for defenders. Rather than only harvesting typed passwords, attackers pair the DNS redirect with Microsoft’s device-code authentication flow. The victim is shown what looks like a normal sign-in prompt and approves it, unknowingly authorizing an attacker-initiated session. The result is a valid OAuth token that already satisfies multi-factor authentication, because the user just approved it. No password is stolen and no MFA prompt is bypassed in the traditional sense; the user grants the session directly.
Who is being hit
ReliaQuest says traffic to the malicious infrastructure has come from organizations across financial services, professional services, legal, healthcare, energy, and retail, a spread the firm characterizes as broad, non-selective targeting of anyone traveling for business rather than a campaign aimed at one sector.
The firm assesses, at medium-to-low confidence, that some of the tradecraft resembles techniques associated with APT28 (also tracked as Fancy Bear and Forest Blizzard), a Russian military intelligence-linked group. The overlaps ReliaQuest cites are gateway-level DNS poisoning aimed at Microsoft authentication domains, small-office and home-office router compromise as an entry point, and adversary-in-the-middle theft of Microsoft 365 sessions. ReliaQuest is careful to frame this as tradecraft reuse rather than attribution: the infrastructure, domain registrations, and implementation details differ from documented APT28 campaigns, and the indiscriminate way this campaign redirects all DNS traffic suggests, in the firm’s assessment, operators less sophisticated than a state actor typically associated with that tradecraft.
What it means for the security leader
The campaign is a reminder that identity has moved past the password and the MFA prompt. It now depends on the network path a device takes to reach an identity provider, and a corporate laptop on hotel Wi-Fi has effectively left the enterprise’s control of that path. A security team can enforce phishing-resistant MFA, patch every endpoint, and still lose a session if the DNS answer the device receives is simply a lie.
It also raises the value of scrutinizing Microsoft’s device-code authentication flow specifically. The flow exists to let devices without a browser, such as smart TVs or CLI tools, authenticate, but it becomes a liability the moment an attacker can put a normal-looking approval prompt in front of a distracted user on unfamiliar Wi-Fi. CyberTech has previously covered a related pattern in voice-phishing crews abusing Microsoft Entra passkey enrollment to sidestep MFA; this campaign is a network-level cousin of the same problem, tricking the user into completing an authentication step the attacker actually needs.
The broader lesson for a security operations team is that “assume breach” now has to extend past the corporate perimeter and into every network a traveling employee joins for a few hours. A gateway a company does not own, cannot patch, and cannot monitor has effectively become part of that company’s authentication path, and this campaign shows attackers already treat it that way even without state-level resources behind it.
What to do
ReliaQuest’s top recommendation is the most direct: enforce always-on, full-tunnel VPN on corporate devices, so that traffic reaches the corporate network before it ever touches the hotel gateway’s DNS. That single control removes the attack’s leverage point.
Beyond the VPN mandate, ReliaQuest recommends auditing proxy authentication logs for sign-ins from unrecognized hosts, disabling WPAD via Group Policy wherever it is not explicitly needed, and restricting PAC file retrieval to approved internal hosts. On the identity side, security teams should disable the device-code authentication flow through Conditional Access policies in Microsoft Entra ID unless a specific, inventoried use case requires it, and should push DNS encryption, DNS-over-HTTPS or DNS-over-TLS with plaintext fallback disabled, on managed devices so a poisoned gateway cannot simply hand back a forged answer. Finally, traveling employees should be trained to treat any login prompt encountered on public Wi-Fi, however normal it looks, with the same suspicion as an unsolicited email link.
Source: ReliaQuest
