The Hidden Threat in Hotel Lobby Wi-Fi
When you're checking into your hotel or settling into a conference center in 2026, the last thing you're probably thinking about is the security posture of the Wi-Fi gateway. You just want to connect, check your email, and get some work done. But security and compliance analysts are increasingly concerned about a persistent campaign where attackers hijack those very gateways to steal your Microsoft 365 credentials—or worse, your authorization tokens.
This isn't theoretical; it's happening right now in major cities across the U.S., India, and Saudi Arabia. It's a stark reminder that even in the most mundane environments, we have to treat public infrastructure as essentially hostile until proven otherwise.
How Wi-Fi Gateways Become Attack Vectors
The attackers aren't necessarily targeting the guests directly at first; they are gunning for the Wi-Fi equipment itself. Based on insights from ReliaQuest, we know these threat actors gain administrator access to Wi-Fi gateways. Often, this is because the management interfaces—be it SSH, SNMP, or those standard web admin dashboards—are weakly protected or entirely exposed to the public. Research into threats like AryStinger shows how outdated network hardware remains a persistent entry point for adversaries seeking gateway-level control.
Once an attacker has that admin access, they subtly modify the gateway's DNS settings. This is the crucial step. They are effectively man-in-the-middling the entire network's DNS traffic at the source. This allows them to redirect traffic for legitimate services—specifically Microsoft sign-in pages—to their own infrastructure.
The Microsoft 365 Token Theft
This is where the threat gets sophisticated. They've registered domains specifically to impersonate Microsoft services, like m365-owa[.]com or ms365-device[.]com. When an unsuspecting employee tries to log in, they land on a pixel-perfect, fake portal. The broader ecosystem of Microsoft 365 phishing continues to evolve, with platforms like Forg365 automating and scaling these credential-harvesting campaigns.
The most dangerous part is how they handle multi-factor authentication (MFA). They don't just capture passwords. In some scenarios, they leverage the legitimate device-code authentication flow. The victim sees a prompt, approves it, and thinks they've completed a normal authentication process. In reality, they are authorizing an attacker-initiated request. This results in the attacker receiving a legitimate OAuth token, completely bypassing MFA without needing to steal the password itself. For a deeper look at how device-code phishing and authentication workflow exploits enable these attacks, see our analysis of MFA bypass techniques.
This bypass is why credential-based defenses alone are insufficient if the attacker pivots to session-based hijacking using these tokens.
Why Technical Controls Can Fail
Many users think that their laptop's security or using a public DNS provider (like Google's 8.8.8.8) is sufficient to protect them. Unfortunately, in this scenario, that's not enough. Because the hotel gateway itself is compromised, it is forging those DNS requests before they ever reach an external resolver.
Furthermore, attackers have been spotted attempting to abuse Web Proxy Auto-Discovery (WPAD). If they successfully push a malicious proxy auto-configuration (PAC) file to a machine, they could theoretically route all traffic—web apps, Chrome, everything—through a proxy they control, further deepening their visibility into the victim's traffic.
This underscores a critical lesson for any security and compliance analyst: our defense-in-depth strategies must assume that network-level controls (like standard DNS configurations) can be compromised by a threat actor with gateway-level access.
Essential Defensive Strategies for Modern Travel
So, how do we protect our users? We need to move away from relying on network transparency and adopt a mindset of continuous, hardened security.
First and foremost, the most effective defense is an always-on, full-tunnel VPN. This forces all traffic through a secure, encrypted tunnel to your corporate infrastructure, ensuring the hotel's compromised gateway cannot perform DNS manipulation on your traffic. If your organization doesn't have an always-on VPN, encrypted DNS in strict mode (like DNS over HTTPS) is a critical baseline.
Beyond VPNs, consider these steps to tighten your security and compliance center:
- Disable WPAD: It's an insecure, legacy feature that is far too easily abused in public network settings.
- Monitor and Review Logs: If you have endpoint detection tools, monitor for unusual proxy configurations or DNS anomalies.
- Re-evaluate Device Code Authentication: If it isn't strictly necessary for your workflows within Microsoft Entra, disable device-code authentication flows to prevent this specific OAuth token abuse.
This campaign, which bears striking similarities to earlier attacks like FrostArmada, highlights the persistent nature of these threats. They aren't going to stop targeting traveling employees, especially as hybrid work becomes the norm. As security professionals, we need to ensure our policies, endpoint configurations, and user training reflect this reality. Don't let your employees be an easy target just because they needed to check their email in a lobby. Treat all public Wi-Fi with suspicion, and build your technical defenses to match.
