Hotel Wi-Fi Hijacked for Fake Microsoft Logins

Cybercriminals are actively compromising Wi-Fi equipment in hotels and conference centers, creating a significant threat to business travelers. These attacks redirect users attempting to access legitimate Microsoft 365 login pages to sophisticated fake sites designed to harvest credentials. The campaign has been ongoing since at least June, with compromised gateways identified in multiple U.S. cities and impacting various sectors, including finance, legal, and healthcare.

Attackers gain administrative access to Wi-Fi gateways, altering DNS settings to misdirect traffic. This allows them to present convincing login pages that mimic official Microsoft portals, potentially collecting usernames and passwords. In some instances, more deceptive methods involving device code authentication prompts are used to bypass multi-factor authentication by tricking users into authorizing malicious sessions.

Researchers also noted attempts to exploit Web Proxy Auto-Discovery (WPAD) protocols, indicating attackers may be looking for broader network access beyond just login credentials. While public DNS services might offer some protection, they are not a foolproof defense against these altered gateway configurations. Encrypted DNS is recommended for enhanced security.

To mitigate these risks, travelers should utilize always-on full-tunnel VPNs, consider using their phone's cellular hotspot, and meticulously verify all login page URLs. Extreme caution is advised with unexpected device code requests, and prompt software updates are crucial. Companies are encouraged to review security settings, including disabling unnecessary features like device code authentication and WPAD, and monitor login activities for anomalies.