Microsoft 365 Phishing Campaign Hijacks Hotel Wi-Fi DNS

In July 2026, cybersecurity research from ReliaQuest exposed a sophisticated, stealthy cyber espionage campaign targeting executive and enterprise travelers across the globe. Threat actors have been compromising the network gateway appliances installed at high-profile hotels, convention centers, and international hospitality venues to conduct localized Domain Name System (DNS) hijacking. Unlike traditional social engineering campaigns that rely on suspicious email links or malicious attachments, this operation weaponizes public network infrastructure to intercept legitimate web traffic. Connected users attempting to access corporate cloud applications are silently steered toward convincing Microsoft 365 phishing portals, leaving endpoint security controls unaware while granting adversaries persistent access to high-value enterprise environments.

The campaign, which has been actively operating since at least June 2026, targets corporate staff spanning critical infrastructure, global financial institutions, legal firms, healthcare conglomerates, energy providers, and retail operations. By poisoning DNS responses directly on venue gateway appliances, the attackers bypass traditional email gateway filters, web reputation systems, and standard endpoint protection tools. The operation highlights a growing shift in cyber adversary tradecraft: compromising the underlying network layer to manipulate authentication workflows before traffic ever leaves the local network environment.

Understanding the Hospitality Gateway Vulnerability and Microsoft 365 Phishing Dynamics

The hospitality sector has long presented an attractive target for threat actors due to its high concentration of roaming corporate executives, legal counsel, government contractors, and financial analysts. Public Wi-Fi environments—such as captive portal systems at hotel chains, airports, and exhibition centers—are managed by specialized gateway appliances designed to handle bandwidth allocation, guest authentication, and routing. However, these appliances often suffer from administrative neglect, unpatched firmware vulnerabilities, or exposed management consoles.

In this campaign, adversaries target exposed administrative interfaces to modify the local DNS resolution rules on captive portal appliances. When an enterprise employee connects to hotel Wi-Fi and launches a browser to check corporate email via Outlook Web App (OWA) or Microsoft Entra ID (formerly Azure Active Directory), the compromised router intercepts the outbound request. Instead of returning the authentic IP addresses associated with Microsoft’s official content delivery network, the router serves a forged DNS response pointing to an attacker-controlled server hosting a duplicate login portal.

Key Infrastructure and Indicator Mapping

ReliaQuest’s threat research team identified a cohesive network footprint operated by the threat group. Analysis of the infrastructure revealed specific domains and IP addresses deployed in these localized adversary-in-the-middle (AiTM) operations:

• Spoofed Microsoft Portals: Threat actors registered domain infrastructure designed to closely mimic official Microsoft endpoints, including m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com.
• Command & Control Infrastructure: Malicious portals were hosted on dedicated external IP addresses, specifically 31.57.243[.]154 and 104.194.159[.]150.
• Poisoned DNS Response IPs: Injected DNS records at the hotel router layer pointed guest web traffic to response addresses such as 38.146.28[.]75 to orchestrate silent traffic redirection.
• Valid TLS Certificates: Attackers provisioned legitimate SSL/TLS certificates for their spoofed domains, ensuring that victim web browsers displayed green lock icons and issued no certificate security warnings during HTTPS sessions.

Deconstructing the Multi-Stage Attack Chain: From Router Hijack to Token Theft

The mechanics of this enterprise campaign rely on a structured, multi-tier exploitation process that combines low-level network tampering with advanced identity protocol manipulation. Understanding each link in the attack chain is essential for SOC teams defending mobile personnel.

1. Gateway Intrusion and Admin Compromise: Attackers gain initial administrative access to public Wi-Fi gateways. This is achieved by scanning for exposed management ports running Secure Shell (SSH), Simple Network Management Protocol (SNMP), or web-based administration panels. Adversaries leverage default vendor credentials, weak passwords, or unpatched remote code execution (RCE) vulnerabilities in gateway firmware.
2. DNS Record Poisoning: Once inside the gateway’s administrative console, the attackers alter the local resolver settings or introduce custom static DNS entries. Requests destined for legitimate Microsoft cloud hostnames—such as login.microsoftonline.com or outlook.office.com—are intercepted at the local gateway level.
3. Adversary-in-the-Middle (AiTM) Redirection: As guests log onto the network and attempt routine business activities, their devices send DNS queries to the hotel gateway. The gateway responds with the attacker’s IP address, directing the browser to the fake login portal. Because the attacker operates legitimate TLS encryption on their lookalike domain, the user sees an encrypted, official-looking sign-in page.
4. OAuth Device-Code Flow Manipulation: To circumvent Multi-Factor Authentication (MFA), the campaign frequently moves beyond basic password harvesting to exploit Microsoft’s OAuth 2.0 Device Authorization Grant flow (commonly known as the Device Code flow). The fake portal prompts the user to input a single-use device verification code. In the background, the attacker’s infrastructure initiates an authentication session with Microsoft’s real identity platform. The victim is instructed to authorize the device request on what appears to be a corporate verification screen.
5. Session Token Capture and Account Takeover: Once the victim approves the device code prompt and satisfies any MFA challenge (such as push notifications or authenticator app prompts), Microsoft Entra ID issues valid OAuth access and refresh session tokens directly to the attacker’s application session. The adversary obtains an authenticated session without ever receiving or needing the victim’s plaintext password.

Attribution and Tradecraft Echoes of Russian APT28

Cybersecurity researchers at ReliaQuest noted striking technical overlaps between this campaign and previous operational tradecraft linked to Russian state-sponsored threat actors, specifically APT28 (also tracked as Fancy Bear, Forest Blizzard, and Strontium). In early 2026, security agencies warned of the “FrostArmada” campaign, wherein APT28 compromised Small Office/Home Office (SOHO) routers globally to modify DNS settings and conduct AiTM authentication intercepts against government and military targets.

The resort and hospitality campaign mirrors FrostArmada’s core methodology—combining router-level DNS tampering with downstream Microsoft cloud identity harvesting. However, researchers also noted subtle operational differences. While classical nation-state espionage typically focuses on surgical, highly selective targeting, some compromised hotel gateways in this campaign redirected all outbound guest DNS queries indiscriminately. This broad-brush approach suggests either an expansion into opportunistic intelligence gathering or the adoption of nation-state tradecraft by sophisticated cybercriminal syndicates.

Geographically, telemetry confirmed compromised hospitality gateways operating across major business centers in the United States, India, and Saudi Arabia. The global dispersion underscores that travelers are vulnerable regardless of destination, particularly in cities hosting multinational trade summits, corporate leadership retreats, and industry expos.

Enterprise Impact: Persistence, Lateral Movement, and Data Exfiltration

Gaining an active OAuth session token via device-code manipulation presents severe risks to modern enterprise environments. Unlike traditional credential theft—where a password reset by IT invalidates the compromised data—OAuth refresh tokens can remain valid for extended periods, surviving password resets depending on tenant token lifetime policies.

With an active session token, threat actors can perform a wide range of post-exploitation actions within Microsoft 365 environments:

• Inbox Rule Exfiltration: Attackers create covert OWA forwarding rules to silently copy incoming email correspondence—including financial wire instructions, proprietary intellectual property, and internal communications—to external drop accounts.
• Unauthorized Device Registration: Adversaries register rogue devices within Microsoft Entra ID, establishing long-term persistence that bypasses conditional access rules tied to managed device status.
• Cloud Repository Access: Attackers systematically search and exfiltrate sensitive enterprise documentation stored across SharePoint Online, OneDrive for Business, and Microsoft Teams channels.
• Business Email Compromise (BEC): Using legitimate corporate email accounts, threat actors execute targeted spear-phishing attacks against internal colleagues, external supply chain vendors, and enterprise business partners.

Defensive Guidance and Risk Mitigation Framework

Defending against gateway-level DNS poisoning requires a defense-in-depth strategy that assumes external public networks are inherently compromised. Enterprise security teams must implement controls across the network, identity, and endpoint layers to insulate mobile personnel.

1. Enforce Mandatory Full-Tunnel Corporate VPNs

Organizations must mandate full-tunnel Virtual Private Network (VPN) or Secure Access Service Edge (SASE) clients on all enterprise-managed endpoints. Full-tunnel configurations encrypt all domain queries and web traffic inside an encrypted tunnel directly back to corporate security stacks or cloud security brokers, bypassing local venue DNS resolvers completely.

2. Deploy Phishing-Resistant Authentication (FIDO2 / WebAuthn)

Traditional multi-factor authentication methods—such as SMS codes, voice calls, and push notifications—are vulnerable to AiTM proxies and device-code exploitation. Security administrators should enforce FIDO2/WebAuthn hardware security keys (e.g., YubiKeys) or platform authenticators (Windows Hello, Touch ID). FIDO2 protocols bind authentication requests strictly to the legitimate domain origin in the browser URL bar, causing authentication to fail automatically on spoofed domains like m365-owa[.]com.

3. Restrict or Disable Microsoft Entra ID Device Code Flow

Unless required for specific legacy hardware (such as smart TVs or conference room displays), security administrators should disable or heavily restrict the OAuth Device Code flow across the tenant via Conditional Access policies. Restricting device-code grants prevents users from inadvertently authorizing rogue sessions on personal or untrusted devices.

4. Implement Secure DNS-over-HTTPS (DoH) or Encrypted DNS

Configuring corporate browsers and OS network adapters to use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) with trusted enterprise resolvers ensures that domain queries are cryptographically signed and encrypted. This prevents local network gateways from modifying or forging DNS resolution answers.

5. Monitor Entra ID Sign-In and Audit Logs for Anomalies

Security Operation Centers (SOCs) should create automated detection alerts for specific identity indicators:

• Anomalous Device Code flow completions, especially those originating from unexpected geography or IP addresses.
• Impossible travel alerts occurring when a user completes a sign-in from a hotel network while session activity simultaneously occurs elsewhere.
• Creation of dynamic inbox forwarding rules or new MFA/device registrations shortly following a sign-in event on public Wi-Fi infrastructure.

As remote work and business travel remain fundamental to global commerce, threat actors will continue weaponizing public connectivity. By moving security controls to zero-trust architecture, encrypted network transit, and phishing-resistant identity platforms, organizations can neutralize local network compromises before they lead to enterprise-wide account takeovers.