Threat actors are compromising hotel and conference center Wi-Fi gateways to redirect travelers to fake Microsoft login pages and steal corporate accounts.
The campaign has been active since at least June 2026 and appears to reuse techniques previously associated with the Russian state-backed hacking group APT28, although the researchers stopped short of attributing the activity to the group.
ReliaQuest Threat Research identified compromised captive portal appliances at hotels and conference venues across multiple US cities, as well as in India and Saudi Arabia. Traffic to the malicious infrastructure originated from organizations in sectors including finance, healthcare, legal services, energy, retail, and professional services, indicating that the attackers are targeting traveling employees rather than specific industries.
Captive portal gateways are network appliances that manage guest Wi-Fi access in hotels, airports, conference centers, universities, hospitals, and similar venues. Because these devices control DNS resolution for connected users, compromising a single gateway allows attackers to manipulate web traffic for every guest using the network without infecting individual devices.
According to ReliaQuest, the attackers likely gained administrative access by exploiting exposed management interfaces, such as SSH, SNMP, or web administration panels, combined with weak or reused credentials. Once inside, they modified the gateways' DNS settings to redirect requests for legitimate websites to attacker-controlled infrastructure.
ReliaQuest
The researchers identified four Microsoft-themed domains used in the campaign: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. The infrastructure served fake Microsoft 365 login pages designed to harvest credentials and authentication tokens.
ReliaQuest said the campaign shares several tactics with the “FrostArmada” operation disrupted earlier this year, including gateway-level DNS poisoning and adversary-in-the-middle attacks against Microsoft 365 accounts. However, the researchers noted important differences, including a focus on hospitality Wi-Fi infrastructure and the use of different domains and servers, which prevented direct attribution to APT28 despite overlapping tradecraft.
The investigation also uncovered two additional techniques not previously documented in FrostArmada. In roughly one-third of observed cases, the attackers attempted to abuse Windows' Web Proxy Auto-Discovery (WPAD) feature to route application traffic through malicious proxy servers. ReliaQuest also observed limited abuse of Microsoft's device code authentication flow, allowing attackers to obtain valid OAuth tokens after victims unknowingly approved malicious authorization requests, thereby bypassing the need to steal passwords directly.
The researchers warn that common DNS protections are often ineffective because public DNS services such as Google's 8.8.8.8 still rely on unencrypted DNS traffic that a compromised gateway can intercept and alter. Likewise, endpoint DNS encryption configured in opportunistic mode can fall back to plaintext requests, leaving systems exposed.
ReliaQuest says organizations can largely eliminate this attack vector by enforcing always-on VPNs configured in full-tunnel mode, ensuring all DNS and web traffic is routed through trusted corporate infrastructure before reaching public networks. Additional recommendations include disabling WPAD where unnecessary, blocking Microsoft's device code authentication flow in Entra ID if not required, monitoring authentication activity for connections through unknown proxy hosts, and verifying website URLs before entering corporate credentials.
Leave a Reply