The IT Nerd

Hackers are compromising DNS settings on hotel and conference center Wi-Fi gateways to redirect guests to fake Microsoft 365 login pages and steal account credentials, according to ReliaQuest.

Once attackers gain administrative access to a gateway, they modify its DNS settings to redirect users attempting to access legitimate Microsoft 365 services to phishing pages designed to capture credentials.

The campaign has been active since at least June and has targeted organizations across the financial services, professional services, legal, healthcare, energy and retail sectors. Researchers identified compromised Wi-Fi gateways in multiple U.S. cities, as well as in India and Saudi Arabia.

Seemant Sehgal, Founder & CEO, BreachLock has this comment:

   “Gaining admin access to a hospitality gateway and rewriting its DNS configuration is not something I’d consider a sophisticated operation. The failure point here is that these gateways were reachable with credentials that could be compromised in the first place, and whatever monitoring existed on them was not watching for configuration changes. Every person who authenticated to Microsoft 365 over that network handed over credentials they will now use on a corporate device, inside a corporate environment, and the organizations they work for have no visibility into that event at all.”

Denis Calderone, CTO, Suzu Labs provided this comment:

   “This is becoming more and more common. This is basically the same playbook as what APT28 did with 18,000 home routers in the FrostArmada campaign back in April. In this case the attacker is targeting legitimate hotel Wi-Fi gateways. The initial access is likely through exposed admin interfaces and the attack is simple enough; they are just reconfiguring DNS settings so all clients connected to the AP get fraudulent DNS responses of their choosing. When a guest’s laptop asks where login.microsoftonline.com is, the gateway sends them to the attacker’s server instead. It’s simple, effective and is sweeping in its scope.

   “The attackers are using two techniques for compromising user accounts. The first is simple enough, it just involves presenting an attacker-controlled fraudulent Microsoft logon page. The other technique is even more concerning. The second technique involves device-code authentication abuse, where the user is redirected to what looks like a normal Microsoft authorization approval prompt, and if the user approves it, it actually authorizes a session the attacker initiated. Microsoft issues a valid OAuth token to the attacker’s client, and that token is already MFA-satisfied. No credentials stolen, no tokens intercepted, MFA completely bypassed. Device-code authentication was designed for input-constrained devices like smart TVs and conference room displays, but it’s enabled by default in Entra ID and many enterprises have never turned it off because they don’t know it’s there. This should be disabled via Conditional Access for all users except the handful of service accounts or device groups that genuinely need it.

   “For the DNS side, the goal is to force managed devices to control their own DNS resolution and ignore whatever the local network hands them via DHCP. The generic advice is encrypted DNS in strict mode, and that’s correct, but how you implement it matters because strict DNS pinning to a public resolver will break most hotel captive portals and can also break on-premises Active Directory domain resolution if you’re running a hybrid environment. If you’re a Cloudflare shop, the WARP agent handles this the cleanest. It has built-in captive portal detection that temporarily allows local unencrypted DNS just long enough for the user to accept the hotel terms, then locks everything down through Cloudflare’s encrypted tunnel.

   “If you’re running Cisco, the Umbrella roaming client does the same thing, binding to the network stack and tunneling DNS to Cisco’s resolvers regardless of what DHCP says. If you’re a Microsoft house, you can push encrypted DNS settings natively through Intune. The setting you want is called ‘Strive’ mode, which attempts encrypted DNS first but temporarily falls back to plaintext when it can’t connect, like when you’re stuck behind a hotel login page. The stricter ‘Require’ mode gives you better protection but will completely break internet access on any network that blocks outbound encrypted DNS until you authenticate, which is most hotels. And if you already have an always-on VPN deployed, make sure captive portal remediation is configured, because without it your users can’t authenticate to the hotel portal to get online in the first place, and the workaround is usually disabling the VPN entirely, which defeats the purpose.

   “Also disable WPAD via Group Policy. ReliaQuest saw the attackers attempt WPAD abuse in roughly a third of cases, serving a malicious proxy config that would route all Windows application traffic through the attacker’s proxy. WPAD is on by default in Windows and almost nobody needs it.”

Damon Small, Board of Directors, Xcape, Inc. followed with this comment:

   “Compromising hotel network gateways to hijack DNS traffic exposes traveling executives to silent account takeover without touching corporate email perimeters. When adversaries gain administrative control over hospitality Wi-Fi access points, they modify local DNS settings to route Microsoft 365 login attempts to credential harvesting portals. Security leaders must operate on a fundamental principle: never trust any network that you yourself do not control. Because remote employees frequently connect through untrusted public infrastructure, organizations must provide tamper-resistant access methods, such as an always-on full-tunnel Virtual Private Network (VPN), to encapsulate all DNS and application traffic. Enforcing encrypted tunnels alongside phishing-resistant multi-factor authentication ensures corporate identities remain secure even when local network environments are fully compromised.

   “Critical Takeaways

• Assume local networks are hostile: Treat every hotel, conference center, and public network as untrusted, operating under the assumption that local DNS resolution may be compromised.
• Mandate tamper-resistant access: Enforce always-on full-tunnel VPN policies on all corporate endpoints to route all DNS and web traffic through secure corporate resolvers.
• Enforce phishing-resistant authentication: Deploy FIDO2 tokens or passkeys and disable vulnerable authentication flows to prevent token theft even if a user reaches a forged portal.

   “An always-on full-tunnel VPN turns an untrusted hotel network back into what it was meant to be: simple commodity bandwidth.”

John Strand, Owner, Black Hills Information Security, Inc. has this comment:

   “This attack reminds me of the Wall of Sheep that’s been a fixture at security conferences for years. The lesson has always been the same. If you don’t trust the network, then don’t trust the network. On a public WiFi connection, you have no control over the DNS settings, the proxy configuration, or what traffic is being monitored or manipulated. That’s why anyone accessing sensitive corporate resources should be connecting through a trusted corporate VPN or, in many cases, avoiding public WiFi altogether by using a cellular hotspot. Security professionals have been warning people not to trust public wireless networks for well over 15 years. This attack doesn’t introduce a new lesson. It reinforces one we’ve known all along.”

Larry Pesce, VP of Services, Finite State adds this:

   “What surprises me most isn’t the technique, it’s the timeline. Security researchers have been demonstrating and warning about exactly this class of attack for the better part of a decade. Compromise the gateway, own DNS, and you own where every guest thinks they’re going. What’s new here isn’t the method, it’s that we finally have large scale, in-the-wild evidence that real threat actors are operationalizing it. The gap between ‘we know this is possible’ and ‘we can prove it’s happening’ just closed, and that should worry anyone who travels for work.

   “For years the standard response to this kind of research was ‘sure, but who’s actually doing it?’ These findings are the answer. DNS on a network you don’t control is trust by default, and these attackers are simply cashing in on that trust.

   “The attribution here is worth understanding, but so is the caveat. ReliaQuest connects this to tradecraft overlapping with APT28, the Russian military intelligence group also known as Fancy Bear or Forest Blizzard, and specifically to a prior router-based operation they call FrostArmada. But they are careful, and rightly so. They are pointing at technique similarity, not shared infrastructure or code reuse, so this is a low to medium confidence link, not a fingerprint. That distinction matters, because it’s easy for headlines to turn ‘looks like’ into ‘is.’

   “If this is APT28 or something in that orbit, the interesting shift is who they went after. Groups like this have historically been surgical, redirecting only traffic that matched specific keywords or targets. What researchers describe here is the opposite: non-selective redirection that scooped up anyone who connected. The sector spread backs that up. Financial services, legal, healthcare, energy, professional services, retail, across US cities, India, and Saudi Arabia. That isn’t a laser pointed at one industry. That’s a net.

   “And that’s the part I want people to sit with. Even if a nation-state actor is ultimately hunting a handful of high-value people, they don’t know who’s going to sit down at that hotel lobby Wi-Fi. So they take everyone. Your credentials might not be the prize, but they are an asset. A mailbox at an unrelated company is a launch pad for business email compromise. A retail employee’s login is a foothold, a pivot, a way to look legitimate on the way to the real target. In espionage terms, access is access, and low value access still has value.

   “A takeaway isn’t ‘I’m not important enough to be a target.’ On a shared, compromised network, importance is decided after the fact. You give up the credential first, and someone else decides later how to monetize or weaponize it. That’s exactly why the hygiene matters for everyone, not just the executives and the obvious high-risk roles. The person who assumes they’re not worth targeting is often the easiest way in.

   “The core lesson is that connecting to a network is not the same as trusting it. Whoever controls the gateway controls name resolution, and if that gateway is compromised, your device will happily follow it straight to a fake Microsoft 365 login page.

   “Here’s the part people get wrong: WPA2 and WPA3 do not save you here. Wi-Fi security encrypts the link between your laptop and the access point. It says nothing about whether the gateway sitting behind that access point is honest. A hotel network can be fully WPA3 protected and still be poisoning your DNS. Link-layer encryption is not the same as a trustworthy network.

   “Assume any network you don’t own is hostile. Use a VPN or encrypted DNS, such as DNS over HTTPS or DNS over TLS pointed at a resolver you trust, so a compromised gateway can’t silently redirect you. Take TLS certificate warnings seriously instead of clicking through them. And move to phishing resistant authentication like passkeys or FIDO2 security keys, because even a perfect looking fake login page can’t replay a hardware-backed credential. If Microsoft 365 suddenly asks you to log in again on hotel Wi-Fi, that’s your cue to stop and get suspicious.”

This is a simple travel maxim. If you can’t see the router, or you can see it but you cannot control it, you can’t trust it. The easy fix is to use a VPN. It doesn’t matter which one. And it doesn’t matter if this is a corporate account or a personal one. Any WiFi that you can’t see or you can’t control is untrustworthy by default.