Corporate travel is a nightmare for identity defense, and attackers know it. Instead of sending phishing emails that get flagged by standard filters, threat actors are breaking directly into physical Wi-Fi gateways at hotels and conference centers. Once inside the router hardware, they tamper with local DNS settings to silently redirect web connections meant for Microsoft 365 right into fake login portals.
This isn't a theoretical lab trick. Security firm ReliaQuest discovered active campaigns operating across the United States, India, and Saudi Arabia since at least June 2026. The attackers didn't pick single verticals either. They targeted executive travelers across financial services, legal firms, healthcare networks, energy companies, and major retailers. Cybersecurity researchers link these router-level tactics to APT28 (also known as Fancy Bear or Forest Blizzard), extending the playbooks seen in earlier FrostArmada campaigns. If your team relies on unmanaged hotel Wi-Fi when traveling, your endpoint posture has a major blind spot.
Anatomy of the Hospitality DNS Poisoning Campaign
Subverting network hardware is surprisingly straightforward when management interfaces sit open to the internet. Threat actors scan hospitality networks for exposed management ports running SSH, SNMP, or outdated web administration dashboards. Weak administrative passwords or unpatched firmware vulnerabilities let them claim full root access on the gateway device.
With administrative control established, the attackers alter the gateway's internal DNS resolver tables. When a guest connects their laptop and tries to reach legitimate cloud platforms, the compromised gateway intercepts the request and serves up malicious IP addresses. Changing local network settings on the endpoint to public resolvers like Google's 8.8.8.8 or Cloudflare's 1.1.1.1 won't save you. Plain-text DNS requests travel over UDP port 53 without encryption. The compromised router intercepts and alters those packets long before they reach external resolvers across the internet.
To make the traps believable, the threat actors registered several convincing domain names designed to mimic legitimate Microsoft single sign-on endpoints:
m365-owa[.]comowa-ms365[.]comms365-device[.]comms365-live[.]com
When traveling personnel open their browser, they end up on high-fidelity replicas of standard cloud sign-in prompts. Handing over credentials on these sites gives attackers direct, unauthenticated access to corporate accounts.
Bypassing MFA With Device Code Prompts and Malicious WPAD
Stealing credentials is only step one when multi-factor authentication (MFA) is enforced. As detailed in our breakdown of MFA bypass techniques and phishing toolkits, attackers need ways around secondary verification prompts. In this campaign, threat actors heavily relied on Microsoft's Device Code authentication flow.
When redirected to phishing portals such as ms365-device[.]com, users see a prompt asking them to enter a code on an official-looking authorization page. What the user doesn't realize is that approving that prompt validates an authentication session initiated by the attacker's client. Once approved, Microsoft's OAuth architecture issues a valid session token straight to the attacker. MFA gets bypassed cleanly because the victim authorized the transaction voluntarily.
In roughly a third of the investigated breaches, attackers went further by abusing Web Proxy Auto-Discovery (WPAD). When Windows devices connect to a new network, they issue automatic WPAD lookups to discover local network settings. The compromised hotel gateway responds with a malicious proxy auto-configuration (PAC) file, attempting to force applications like Google Chrome through an adversary-controlled proxy server. This strategy is part of a broader trend of automated identity exploits, much like the AI-driven techniques seen in Forg365 phishing platforms targeting Microsoft 365.
An initial identity foothold in Microsoft 365 rarely stays isolated. Once inside, attackers inspect internal communications, pull executive documents, and discover interconnected enterprise tools. If an enterprise links identity providers to critical databases or enterprise resource planning platforms, compromised cloud tokens open doors to internal erp software security controls. An adversary holding valid OAuth session tokens can navigate core business operations while bypassing standard login anomaly detection.
Action Plan for the Security & Compliance Analyst
Defending remote teams against gateway DNS hijacking means pulling control back from local network gear into endpoint and identity policies. Asking traveling staff to inspect browser URLs on hotel Wi-Fi doesn't work when underlying router infrastructure lies directly to the operating system.
First, force an always-on, full-tunnel VPN policy across all corporate endpoints. Full-tunnel configurations encapsulate every network packet—including initial DNS queries—inside an encrypted channel routed back to corporate security controls or SASE points of presence. Local hotel routers can't inspect or alter encrypted tunnel traffic.
Second, mandate strict encrypted DNS protocols, specifically DNS over HTTPS (DoH) or DNS over TLS (DoT). Make sure these protocols operate in enforced or strict mode. Running encrypted DNS in opportunistic mode allows endpoints to fall back to plain-text port 53 if encrypted lookups fail—a loophole compromised gateways actively trigger.
Third, kill legacy discovery services across your fleet. Turn off WPAD across Windows endpoints using Group Policy or Mobile Device Management (MDM) profiles. Endpoints shouldn't query untrusted local networks for PAC files under any circumstances.
Fourth, tighten authentication policy within identity controls. Every security & compliance analyst should evaluate device code workflow settings inside the security & compliance center office 365 tenant configurations and Microsoft Entra ID administration panels. Unless your organization explicitly requires workers to register headless devices like smart TVs, turn off device code authentication globally or lock it down with restrictive conditional access policies. This aligns with broader shifts toward phishing-resistant authentication, as discussed in our look at scaling Microsoft Entra ID passkey adoption.
Cross-Domain Security and Compliance Governance
Identity security doesn't exist in a vacuum; it impacts every layer of corporate data protection and overall security & compliance posture. While tools like a security & compliance analyzer veeam integration can verify backup encryption and immutability standards, backup posture won't stop an adversary from hijacking valid user session tokens on a conference center network.
Protecting hybrid teams requires aligning network encryption mandates with strict identity governance. Regular audits must verify that endpoint VPN configurations remain active, legacy authentication protocols stay disabled, and conditional access policies block unauthorized device registration flows. As documented in BleepingComputer's security report, threat actors will keep weaponizing hospitality networks against remote workers. Fixing endpoint and DNS configurations now keeps gateway manipulation from turning into full enterprise breaches.