Hotel Wi-Fi hijack campaign quietly harvests Microsoft 365 logins from business travellers

Key points

• ReliaQuest has tracked a campaign hijacking Wi-Fi gateways at hotels and conference venues since at least June 2024, redirecting guests to fake Microsoft 365 sign-in pages.
• Compromised gateways have been spotted in multiple US cities as well as India and Saudi Arabia, hitting finance, legal, healthcare, energy and retail visitors.
• The attackers registered at least four lookalike domains, including m365-owa[.]com and ms365-live[.]com, to host the phishing pages.
• A device-code trick lets attackers in even when the victim has multi-factor authentication switched on.
• ReliaQuest assesses with medium confidence that the activity overlaps with FrostArmada router operations linked to APT28, also tracked as Fancy Bear or Forest Blizzard.

Someone has been quietly rewiring the Wi-Fi at hotels and conference centres so that business travellers who try to log into Microsoft 365 end up on a fake page instead.

The campaign, first reported by BleepingComputer and detailed by ReliaQuest, has been running since at least June 2024. It targets the Wi-Fi gateways that guests connect to, not the guests' own devices. Our May reporting on Forest Blizzard's mass DNS hijacking of SOHO routers shows this crew has form here: the hospitality setting is new, the technique isn't.

How does the attack actually work?

The attackers break into the Wi-Fi gateway itself, the box that hands out internet access in a lobby or conference hall, and rewrite its DNS settings. DNS is the internet's phone book: it turns a name like login.microsoftonline.com into the numeric address your device actually reaches.

With the phone book rewritten, a guest who types the real Microsoft address is quietly sent to a copycat page the attackers control. ReliaQuest says the crew registered at least four lookalike domains: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com and ms365-live[.]com.

How they get onto the gateways isn't yet clear. ReliaQuest suggests exposed admin interfaces left open to the internet, or unpatched flaws in the appliances themselves.

Does multi-factor authentication stop this?

Not on its own. In some cases the attackers use a device-code flow, a legitimate Microsoft feature designed for signing in on a screen-only device by approving a prompt elsewhere.

The fake page shows the victim a real-looking Microsoft prompt. Approving it doesn't log the victim in. It logs the attacker in, on their own machine, with a valid session token issued by Microsoft. No password is stolen, no MFA code is intercepted, because the attacker never needed either. ReliaQuest's earlier Forg365 write-up covered how the same device-code abuse appears in off-the-shelf phishing kits, which tells you how accessible the technique has become.

Who is behind it?

ReliaQuest assesses with medium confidence that the tradecraft overlaps with FrostArmada, a router-focused campaign attributed to APT28, the Russian military intelligence group Microsoft tracks as Forest Blizzard and others call Fancy Bear.

Attribution here is a capability-and-TTP match, not a signed confession. Targeting travelling staff through hospitality Wi-Fi fits APT28's known interest in intelligence collection, but ReliaQuest stops short of a hard call. That caveat matters: similar DNS manipulation is showing up from more than one threat cluster right now.

In roughly a third of investigated cases the attackers also probed Web Proxy Auto-Discovery, a Windows feature that looks for a proxy server automatically. By answering that lookup with a malicious config file they could in theory route traffic through their own server. ReliaQuest couldn't confirm this worked in practice.

Should you worry if you travel for work?

Switching to a public DNS like 8.8.8.8 won't help here: the compromised gateway intercepts the request before it leaves the building. ReliaQuest recommends an always-on VPN that tunnels all traffic, encrypted DNS in strict mode, and disabling device-code sign-in in Microsoft Entra ID where it isn't needed.

For most travelling staff the practical floor is lower: use your phone's hotspot for anything sensitive, and treat any Microsoft login prompt on hotel Wi-Fi as suspect until proven otherwise.