Hotel and Conference Wi-Fi Networks Hijacked to Steal Corporate Login Details
Criminals are quietly rewriting the internet directions on public Wi-Fi routers at hotels and conference centres, then catching employees' Microsoft 365 passwords mid-air. Researchers say the campaign has been running since at least June 2026.
Key points
- Criminals have been tampering with public Wi-Fi routers at hotels and conference centres across the US, India and Saudi Arabia since at least June 2026.
- The attack changes DNS settings (the address book that tells your device where websites live) to silently redirect users to fake Microsoft login pages.
- Victims span financial services, legal, healthcare, energy and retail firms, confirming no single industry is being singled out.
- Cybersecurity firm ReliaQuest identified four attacker-registered domains used to serve fake Microsoft sign-in pages.
- The campaign shares tactics with a previously documented Russian state-linked operation called FrostArmada, but the infrastructure doesn't match.
What actually happened?
Criminals broke into gateway appliances, the hardware boxes that run the sign-in screens you see when you connect to hotel Wi-Fi, and rewrote their DNS settings. DNS (Domain Name System) works like a phone book for the internet: when you type a web address, your device asks a DNS server which numbered address to go to. Altering those settings let attackers silently send every user on that network to a fake Microsoft 365 login page. Passwords typed there go straight to the criminals.
The technique is called adversary-in-the-middle (AitM), where an attacker inserts themselves between a user and a legitimate service, copying everything that passes through. We first reported this campaign on 24 July 2026, when ReliaQuest's findings were still emerging.
ReliaQuest found traffic flowing to tampered gateways from employees across at least six industries. Shared venues hit include hotels and conference centres in the US, India and Saudi Arabia.
Who is behind it?
Nobody's been definitively named. The tactics echo a Russian state-linked operation called FrostArmada, previously attributed to APT28 (also known as Fancy Bear and Forest Blizzard), a hacking group believed to work for Russia's military intelligence service, the GRU. The attacker-registered domains and IP addresses used here don't match infrastructure seen in past APT28 activity.
ReliaQuest notes that applying DNS poisoning to redirect all users at once, rather than targeting specific individuals, points to a "less sophisticated or less careful actor" than APT28. The attackers may be reusing APT28 methods without being the same group.
| Detail | This campaign | FrostArmada (APT28) |
|---|---|---|
| Active since | June 2026 | Previously documented |
| Entry point | Captive portal Wi-Fi gateways | Varied |
| Redirect method | DNS poisoning of all users | More selective |
| Target locations | US, India, Saudi Arabia | Not venue-specific |
| Infrastructure overlap | None confirmed | Known APT28 domains/IPs |
What should travelling employees do right now?
Don't type work passwords into any login screen that appears after connecting to hotel or conference Wi-Fi. If you must connect, use your company's VPN (Virtual Private Network, a private encrypted tunnel that keeps your traffic away from the local network) before opening any work application.
Any employee who connected to public Wi-Fi at a hotel or conference centre in the affected regions since June 2026 and logged into Microsoft 365 should report it to their IT team immediately. Change your Microsoft 365 password from a trusted network. If your account uses multi-factor authentication (MFA), meaning a second confirmation step such as a code sent to your phone, check recent sign-in activity for anything unusual via the Microsoft account security portal.
The blunt truth is that captive portal hardware, built to show you a splash screen before you get online, wasn't designed with credential theft in mind. Until it is, a hotel network is not a safe place to log into anything that matters.
