Reported by 1 outlet
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
bleepingcomputer.com · 81d ago · July 25th, 2026
A campaign active since June 2026 is compromising Wi-Fi gateways at hotels and conference centers to redirect users to fake Microsoft 365 login pages. ReliaQuest identified compromised gateways across multiple U.S. cities, India, and Saudi Arabia, affecting organizations in financial services, professional services, legal, health care, energy, and retail.
Attack chain:
-
Initial access likely through weakly protected management interfaces (SSH, SNMP, web admin dashboards) or unpatched vulnerabilities on Wi-Fi appliances
-
Attacker changes DNS settings to redirect traffic to phishing pages capturing M365 credentials
-
Since devices serve corporate events, hijacking accounts gives access to sensitive business information and communications
ReliaQuest assesses the activity is similar to the FrostArmada router-based campaigns attributed to APT28 (Fancy Bear / Forest Blizzard). The campaign is non-sector-specific, targeting traveling employees wherever they connect.
Action: Enforce MFA resistant to real-time proxy attacks (FIDO2/WebAuthn) for all corporate M365 accounts. Advise traveling employees to avoid using hotel Wi-Fi for work authentication without a corporate VPN. Auditors should review hotel and conference center Wi-Fi provider security postures for event security planning.
-