Hackers are compromising Wi-Fi equipment at hotels and conference centers, transforming ordinary internet connections into conduits for fake Microsoft 365 login pages. This phishing attack poses significant risks for business travelers. You might connect to hotel Wi-Fi before a meeting, open your laptop, and encounter what looks like a standard Microsoft sign-in screen. Unfortunately, the hotel’s compromised network could divert you to a page controlled by cybercriminals.
Cybersecurity Threats and Trends
Cybersecurity firm ReliaQuest reports that this campaign has been active since June. They discovered compromised Wi-Fi gateways in multiple U.S. cities. Industries affected include financial services, professional services, legal, healthcare, energy, and retail. This wide range indicates hackers may be targeting traveling employees across sectors.
Phishing Attack Mechanism
A Wi-Fi gateway directs how connected devices access the internet. Once hackers gain administrative access, they alter the gateway’s Domain Name System settings. DNS functions like the internet’s address book, translating website names into numerical addresses. In this attack, hackers redirect the browser seeking a legitimate Microsoft login page to a fake site. Although your device connects normally, the hotel name may appear in your settings, and other websites may load, making it hard to notice the attack.
Potential Vulnerabilities
ReliaQuest has not confirmed how the attackers initially access the gateways. However, potential entry points include exposed administrative tools, weak passwords, and vulnerable web dashboards. Older equipment with known security flaws can also be exploited if software updates are delayed. Once a gateway is compromised, it can affect numerous devices during an event.
Signs You Are A Target
ReliaQuest identified domains registered by attackers for fake Microsoft portals, such as:
- m365-owa[.]com
- owa-ms365[.]com
- ms365-device[.]com
- ms365-live[.]com
These domains appear authentic and may deceive hurried travelers. Hackers can capture Microsoft 365 credentials, exposing business emails, documents, and services. They might impersonate employees for payment fraud, phishing, or other attacks.
Device Code Authentication Risk
Some incidents involved a deceptive device code authentication flow. A user visiting the fake Microsoft page saw an authorization prompt, which seemed legitimate. However, the hacker had already started an authentication session. Upon user approval, Microsoft issued a genuine OAuth token, granting account access. This bypasses multifactor authentication because the user authorizes the request.
A login prompt demanding device approval deserves scrutiny. Verify the request with your company’s IT department before proceeding.
Looking Beyond Microsoft Credentials
In some cases, attackers attempted to exploit Web Proxy Auto-Discovery (WPAD), a method Windows uses to locate proxy settings. They responded to WPAD requests with malicious proxy files, potentially rerouting traffic through proxies they controlled. Researchers couldn’t confirm the success of these attempts, indicating the attackers’ broader interests beyond login credentials.
Defense Strategies
Switching to public DNS services, like Google’s 8.8.8.8, might seem simple but won’t block this attack. Hackers can intercept DNS requests unless they’re encrypted. Using an always-on VPN or your phone’s hotspot offers better protection when accessing sensitive work accounts.
Safety Measures on Untrusted Networks
While public Wi-Fi can be useful, treat it as untrusted. Here’s how to minimize exposure:
- Always-on VPN: Encrypt your traffic and use a trusted VPN always covering all activities.
- Phone Hotspot: Avoid hotel gateways for brief email or document access. Check data allowances.
- Verify Addresses: Carefully inspect web addresses before entering passwords.
- Caution with Device Codes: Do not approve unfamiliar requests without verification.
- Update Devices: Install updates to secure against vulnerabilities.
- Security Software: Use reliable antivirus software for malicious page detection.
- Review Settings: Companies should disable unnecessary functions and inspect unexpected activity.
Key Advice
This attack showcases how a hotel Wi-Fi may seem normal yet redirect you to fake login pages. Your biggest warning may be unexpected password prompts or device requests. Slow down before signing in, especially when juggling meetings or conference activities. Always use a reliable VPN when possible, or switch to a cellular hotspot for sensitive tasks. Never approve an authentication you did not initiate. Contact IT if anything seems suspicious.
Consider if these Wi-Fi threats will change your connection habits at hotels. Share feedback at CyberGuy.com.
Copyright 2026 CyberGuy.com. All rights reserved.