Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

1. Executive summary

Since at least June 2026, threat actors have compromised Wi-Fi gateway devices at hotels and conference centres, modifying DNS settings to redirect users to fake Microsoft 365 login portals and steal credentials and OAuth tokens. ReliaQuest assesses the activity as similar to the FrostArmada router-based campaigns attributed to APT28 (Fancy Bear); however, no MITRE ATT&CK profile was resolved in the verified reference data for this item, so attribution remains unconfirmed. The campaign is not sector-specific but explicitly impacts financial services among other industries, with compromised infrastructure observed in the U.S., India, and Saudi Arabia. The attack bypasses MFA via device-code authentication flow abuse and, in some cases, attempts WPAD hijacking. EMEA financial services with travelling employees connecting to hotel or conference Wi-Fi are directly exposed to credential theft and session token compromise.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The attack targets employee endpoints on third-party network infrastructure (hotel/conference Wi-Fi) rather than the entity's own ICT systems, and no verified reference data confirms a major ICT-related incident at a regulated entity. General travel-security hygiene and endpoint controls apply but do not trigger a distinctive obligation under the articles in scope.

3. Technical analysis & attack chain

Attribution caveat: ReliaQuest assesses this activity is "similar to" the FrostArmada campaigns attributed to APT28 (a.k.a. Fancy Bear, Forest Blizzard). No MITRE ATT&CK profile was resolved in the verified reference data for this item. Attribution is unconfirmed and rests on a single vendor assessment — treat as directional, not established.

Attack chain (confirmed steps from source)

1. Initial access to Wi-Fi gateway: Method is unclear. ReliaQuest assesses the threat actor likely exploited weakly protected, exposed management interfaces (SSH, SNMP, web admin dashboards) or unpatched vulnerabilities on the gateway devices. No specific CVE or exploit is identified.
2. DNS modification: Once administrator access is obtained, the attacker modifies the gateway's DNS settings to redirect connections targeting legitimate Microsoft domains to attacker-controlled infrastructure.
3. Fake login portal delivery: Users attempting to access legitimate Microsoft login portals are transparently redirected to phishing pages hosted on attacker-registered domains. Four domains have been identified: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com.
4. Credential capture: Users enter credentials into the fake portal.
5. MFA bypass via device-code flow: In some cases, targets are redirected to a fake Microsoft page presenting a device-code authentication prompt. When the user approves the prompt, they authorise a session initiated by the attacker, causing a legitimate OAuth token to be issued to the attacker's client. This bypasses MFA without stealing credentials or intercepting access tokens.
6. WPAD hijacking (attempted, unconfirmed success): In approximately one-third of investigated cases, attackers responded to Windows' automatic WPAD lookup with a malicious proxy auto-configuration (PAC) file. This would route traffic from Windows applications (including Chrome) through an attacker-controlled proxy. ReliaQuest could not confirm these attempts were successful.

Key technical notes

• Using public DNS servers (e.g., Google 8.8.8.8) does not prevent this attack — the gateway forges plain-text DNS requests before they reach the intended resolver.
• The campaign has been active since at least June 2026.
• Compromised gateways were observed serving corporate events, meaning travelling employees on business trips are the primary target vector.
• Sectors confirmed in traffic to compromised gateways: financial services, professional services, legal, healthcare, energy, and retail.

4. Mitigation & containment

P1 — Within 24 hours

• Disable Device Code authentication flow in Microsoft Entra ID when not required. This eliminates the MFA-bypass vector used in step 5 of the attack chain.
• Block the four known attacker domains at DNS, proxy, and EDR network-content-filter layers: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, ms365-live[.]com.
• Issue a travel-security advisory to all staff: do not authenticate to Microsoft 365 over hotel or conference centre Wi-Fi without an active full-tunnel VPN.

P2 — Within 72 hours

• Disable WPAD on all Windows endpoints via Group Policy: set Computer Configuration > Administrative Templates > Network > WPAD > Turn off WPAD to Enabled. Alternatively, disable the WinHttpAutoProxySvc service.
• Review Microsoft Entra ID sign-in logs for suspicious activity: look for token issuance from unexpected IP geographies, device-code flow authentications, and conditional-access policy bypasses correlating to known travel dates of staff.
• Enforce always-on, full-tunnel VPN for all corporate endpoints. Ensure the VPN profile cannot be disabled by the user without administrative privilege.
• Enable encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) in strict mode on corporate endpoints to prevent plaintext DNS forgery at the gateway layer.

P3 — Within 7 days

• Review conditional access policies to require compliant device status for Microsoft 365 authentication — sessions from non-managed or non-compliant devices should be blocked or require step-up authentication that cannot be satisfied via device-code flow.
• Conduct a retrospective review of Entra ID audit logs since June 2026 for OAuth token grants and application consent activity matching the attack pattern.
• Update corporate travel security policy to mandate VPN use on all non-corporate networks and include this scenario in security awareness training.

5. Indicators of compromise

domain  m365-owa[.]com
domain  owa-ms365[.]com
domain  ms365-device[.]com
domain  ms365-live[.]com

Behavioural indicators

6. Detection

Sigma rule — suspicious device-code flow authentication in Entra ID

title: Microsoft 365 Device-Code Flow Authentication from Unexpected Location
id: 7a3c1f2e-8b4d-4e6a-9c1f-2d5e8a7b3c6f
status: experimental
description: >
  Detects device-code authentication flow activity in Microsoft Entra ID sign-in logs,
  which may indicate MFA bypass via compromised Wi-Fi DNS redirection as observed in
  hotel Wi-Fi DNS hijacking campaigns.
author: Adverse Trace
date: 2026/07/24
references:

  - https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/
logsource:
  product: microsoft
  service: entra_id
detection:
  selection:
    authenticationProtocol: deviceCode
    result: success
  condition: selection
falsepositives:

  - Legitimate device-code flow usage by IoT devices, CLI tools, or applications without
    interactive browser capability. Correlate with user travel status and expected
    geographic location.
level: medium

Sigma rule — WPAD PAC file retrieval from non-corporate network

title: WPAD PAC File Retrieved from Non-Corporate Address
id: 8b4d2e3f-9c5a-4f7b-ad2e-3e6f9b8c4d7a
status: experimental
description: >
  Detects Windows WPAD auto-discovery requests receiving PAC file responses from
  non-corporate IP addresses, consistent with the WPAD hijacking behaviour observed
  in the hotel Wi-Fi DNS hijacking campaign.
author: Adverse Trace
date: 2026/07/24
references:

  - https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/
logsource:
  product: windows
  service: sysmon
detection:
  selection_dns:
    EventID: 22
    QueryName|contains: wpad
  filter_corporate:
    DestinationIp|cidr:

      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  condition: selection_dns and not filter_corporate
falsepositives:

  - Legitimate WPAD configuration on guest networks with local proxy auto-configuration.
level: medium

7. Sources

• BleepingComputer, "Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts," https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/, 2026-07-24
• BleepingComputer, "Hackers target Microsoft 365 accounts with 81 million login attempts," https://www.bleepingcomputer.com/news/security/hackers-target-microsoft-365-accounts-with-81-million-login-attempts/ (context only — describes a separate password-spraying campaign, not the DNS hijack chain)
• BleepingComputer, "ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds," https://www.bleepingcomputer.com/news/security/consentfix-and-clickfix-how-microsoft-365-accounts-are-hijacked-in-3-seconds/ (context only — describes separate OAuth/consent-grant attack patterns)

8. Adverse Trace position

This is a medium-severity threat with high relevance to EMEA financial services organisations with travelling staff. The attack is technically straightforward — DNS manipulation on unmanaged network appliances — but the MFA bypass via device-code flow is effective and difficult for users to detect. Attribution to APT28/FrostArmada is single-sourced from ReliaQuest and unconfirmed; we will not treat this as a state-sponsored campaign without corroboration. The four identified domains are the primary pivot point for immediate blocking. The most impactful defensive action is disabling device-code flow in Entra ID, which directly eliminates the MFA-bypass mechanism. We will monitor for additional domain registrations matching the ms365-* / m365-* naming pattern and update IOCs if new infrastructure emerges. Clients should prioritise the P1 actions today and ensure travel-security policy explicitly mandates full-tunnel VPN on all non-corporate networks.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.