Hotel Trap: Wi‑Fi Gateway Attacks to Steal Microsoft 365 Accounts

Introduction

Since June 2026, a sophisticated cyber espionage campaign has been targeting traveling professionals by compromising Wi‑Fi gateways in hotels and conference centers. Attackers tamper with the network’s DNS settings to redirect victims to fake Microsoft 365 login pages, aiming to steal credentials or, worse, authenticated OAuth tokens that completely bypass MFA. The threat, detected by ReliaQuest researchers, shows strong similarities to the “FrostArmada” operations attributed to the APT28 group (Fancy Bear).

Technical Analysis

The attack unfolds in multiple stages. Initially, criminals seize control of Wi‑Fi gateways, often by abusing administrative interfaces (SSH, SNMP, web panels) exposed with weak credentials or outdated firmware. Once inside, they modify DNS servers to reroute requests for legitimate Microsoft domains to malicious servers.

When a guest connects to the network and tries to open Outlook or Teams, the poisoned DNS directs them to a cloned Microsoft 365 portal. Here the victim can enter their credentials, which are immediately captured. However, the most insidious aspect is the use of the device‑code flow: the attacker presents the user with a screen that prompts them to visit a legitimate Microsoft page (such as microsoft.com/devicelogin) and enter a code displayed on the fake page. By doing so, the victim unknowingly authorizes the issuance of a valid session token that already includes satisfied MFA. The token grants persistent access to the account, without being revoked by a subsequent password change.

In parallel, an attempt to abuse the WPAD (Web Proxy Auto‑Discovery) protocol was observed. By forcing the use of a controlled proxy, the attackers aim to intercept all web traffic. The effectiveness of this technique in the campaign has not been confirmed, but it demonstrates the offensive’s versatility.

The domains employed include m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com and ms365-live[.]com, typically registered with anonymous hosting services to hinder investigation.

Impact

The campaign has hit traveling employees in the United States, India, and Saudi Arabia, with a high concentration in the financial services, professional services, legal, healthcare, energy, and retail sectors. Unauthorized access to Microsoft 365 accounts allows reading emails, theft of confidential documents, and potentially lateral movement into the corporate network. Token theft poses an even greater risk, as it ensures a lasting foothold even after a password reset. Exfiltrated information may include intellectual property, financial data, contracts, and personal files, with legal and reputational consequences.

Mitigation

To counter this threat, organizations must implement a multi‑layered approach:

• Full‑tunnel VPN and encrypted DNS: enforce the use of a corporate VPN that encapsulates all traffic (no split‑tunnel) and enable DNS‑over‑HTTPS (DoH) or DNS‑over‑TLS (DoT) with strict configuration, so as to prevent any tampering at the local network level.
• Disable WPAD: turn off automatic proxy detection both on endpoints (Group Policy on Windows) and on network devices, blocking WPAD requests.
• Block the Device Code flow: if not strictly necessary, remove the device code grant in Microsoft Entra ID (Azure AD portal → Authentication → Grant flows).
• Proactive monitoring: analyze Microsoft 365 session logs for suspicious domains, logins from unusual locations, or new device activations.
• Secure Wi‑Fi gateways: for facility administrators, it is vital to lock down management interfaces: disable SSH, SNMP, and the web interface if not essential, apply timely firmware updates, and use strong, unique credentials.
• Educate travelers: raise staff awareness about the importance of never entering corporate credentials outside of a secure VPN and of being wary of unexpected login pages.

FAQ

1. Why doesn’t multi‑factor authentication protect me from this attack?

The device‑code flow exploited by the attacker is a legitimate authentication mechanism designed for devices without a browser (e.g., smart TVs). When the victim, deceived by the fake page, visits /devicelogin and enters the code, the entire procedure – including MFA verification – occurs authentically. At the end, the attacker receives a token that embeds the already satisfied MFA, thus gaining access indistinguishable from that of the real user.

2. How can I tell if the hotel Wi‑Fi is compromised?

It is nearly impossible for an average user. Possible signs include sudden redirects to unusual login pages, invalid SSL certificates, or requests for codes on external sites. The most effective defense remains assuming the network is hostile: always enable a full‑tunnel VPN before any operation, ensure DNS is encrypted, and never enter credentials without these safeguards.

3. What should a company do if it suspects an employee has been victimized?

Act quickly:

• Immediately revoke all session tokens and force a password reset in Microsoft Entra ID.
• Remove any unauthorized applications or devices associated with the account.
• Examine recent activity logs for anomalous logins, suspicious mail forwarding, or rule creation.
• Alert the security team for a broader investigation, as the attacker may have already extended the compromise to other systems.