Security researchers have identified an active attack campaign that turns hotel and conference center Wi‑Fi gateways into credential‑harvesting weapons. A compromised captive portal can redirect a traveler’s Microsoft 365 authentication to attacker‑controlled infrastructure, silently stealing credentials, session tokens, and even multifactor authentication (MFA) proof—without a single phishing email or malicious attachment. The operation, active since at least June 2026, was detailed in a July 23 report from ReliaQuest and first publicized by TechNadu. It targets the very network equipment guests are conditioned to trust as soon as they type in a room number or accept terms.

The Attack: DNS Poisoning Meets a Captive Portal

Captive portals are the login pages that appear when you connect to guest Wi‑Fi at a hotel, airport, or conference. That gateway sits at a powerful choke point: it controls DNS resolution, routing, and the initial web experience for every connected device. ReliaQuest found that adversaries are gaining administrative access to these gateways—often through exposed management interfaces, weak passwords, or unpatched firmware—and then altering DNS records so that requests for legitimate Microsoft services go to lookalike domains like m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com.

DNS poisoning alone does not break TLS encryption. A modern browser will still reject a certificate that doesn’t match the real domain. But the campaign layers several techniques to overcome that hurdle:

  • WPAD abuse: The Web Proxy Auto‑Discovery protocol lets Windows automatically find proxy settings. An attacker can push a malicious proxy configuration file, routing application traffic through an adversary‑controlled server. That proxy can then relay authentication sessions, capture tokens, or present a convincing replica of the Microsoft sign‑in page.
  • Device‑code authentication trick: Microsoft’s device‑code flow is a legitimate OAuth mechanism for devices that can’t display a full web login. An attacker can trigger this flow, display a code to the victim (often under the pretext of “Wi‑Fi verification”), and have the victim approve the request at a real Microsoft page. Because the victim completes MFA, the attacker gets a fully authorized OAuth token without ever seeing a password.
  • Social engineering via the captive portal: The gateway’s own pages can show a message claiming that “Microsoft verification” is required to restore internet access. The user, expecting network friction, complies and may inadvertently approve an attacker’s session.

The result is an identity compromise that can persist even after a password change, because the attacker holds a valid session token or OAuth refresh token.

What This Means for You—and Why Travelers Are the Primary Target

If you’re a business traveler, a remote worker who uses hotel Wi‑Fi, or an IT administrator supporting a mobile workforce, this campaign directly threatens your Microsoft 365 environment. ReliaQuest’s report notes that the attackers are not targeting specific organizations; they are targeting venues. Once a gateway is compromised, every guest who authenticates to Microsoft 365 while on that network is at risk, regardless of industry. Financial services, legal firms, healthcare providers, energy companies, and retailers have all seen victim traffic.

For the individual user, the typical defense—checking for a lock icon in the browser, avoiding suspicious emails—isn’t enough. The attack exploits the normal, expected behavior of joining a guest network. You might see a portal page that looks routine, or a prompt to “verify your identity” that resembles a Microsoft sign‑in. Because the network itself is hostile, even a passwordless authentication method like a hardware key can be bypassed if the user authorizes a malicious device‑code request.

For IT and security teams, the risk is amplified because employees are often outside the corporate network perimeter, making it harder to detect and block the attack in real time. A compromised account can lead to email forwarding, data exfiltration from OneDrive or SharePoint, impersonation, and business email compromise (BEC) that extends far beyond the initial incident.

How We Got Here: A Pattern of Gateway Exploitation and Token Theft

The campaign didn’t appear in a vacuum. It builds on trends that have been accelerating throughout 2026:

  • March 2026: Microsoft issued a critical alert about the EvilProxy adversary‑in‑the‑middle framework targeting governments and public organizations with device‑code phishing.
  • April 2026: The FrostArmada campaign, attributed to Russian state‑sponsored group APT28 (Fancy Bear), was disrupted after using similar gateway‑level DNS poisoning and token‑theft techniques.
  • June 2026: ReliaQuest began tracking the current hospitality‑Wi‑Fi campaign, which shows operational overlap with APT28 tradecraft but may be a less sophisticated copycat.

The attackers appear to be opportunistic. Exposed management interfaces—SSH, SNMP, web admin panels—on captive portal appliances give them an entry point. Once inside, they can push malicious DNS configurations without needing to compromise any endpoint.

Key to the threat’s effectiveness is the erosion of the network trust boundary. In the Microsoft 365 era, identity is the new perimeter, but that identity is often authenticated over networks we don’t control. When a captive portal can redirect traffic and manipulate proxy discovery, the barrier between a user and a token thief becomes dangerously thin.

What to Do Now: Practical Steps for Individuals and Organizations

The most effective single defense, according to ReliaQuest, is to make the local network irrelevant. That means using an always‑on, full‑tunnel VPN that routes all traffic—including DNS requests—through your corporate infrastructure before the device ever talks to Microsoft’s servers.

For Individuals and Travelers

  1. Use a full‑tunnel corporate VPN before doing anything sensitive. If your organization provides one, make sure it connects automatically on untrusted networks. If you’re on your own, a reputable personal VPN service that encrypts DNS can offer some protection, but corporate VPNs typically provide stronger routing controls and logging.
  2. Never enter your Microsoft password or approve an MFA prompt in response to a captive portal message. A hotel network has no legitimate reason to ask you to verify your Microsoft identity. If you see such a prompt, disconnect immediately and use your phone’s hotspot.
  3. Disable automatic connection to open Wi‑Fi networks. On Windows, go to Settings > Network & Internet > Wi‑Fi and turn off “Connect to suggested open hotspots” and “Connect to networks shared by my contacts.”
  4. Watch for suspicious browser behavior after connecting to guest Wi‑Fi. Unexpected certificate warnings, repeated sign‑in prompts, or pages that look slightly off (check the URL carefully) are red flags.

For IT Administrators and Security Teams

  1. Enforce always‑on, full‑tunnel VPN on managed devices. A split‑tunnel VPN still exposes DNS to the local network. Use device compliance policies to require VPN connectivity before granting access to Microsoft 365 resources.
  2. Disable or restrict the device‑code authentication flow in Microsoft Entra ID unless your organization has a documented business need. Go to the Entra admin center > Security > Authentication methods > Device code and either disable it or scope it to a pilot group. If you must keep it, monitor device‑code events for anomalies.
  3. Turn off Web Proxy Auto‑Discovery (WPAD) on all Windows endpoints. This can be done via Group Policy or Microsoft Intune. The setting is under Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > “Disable caching of Auto‑Proxy scripts” and related proxy policies. For modern browsers, also disable automatic proxy detection.
  4. Implement phishing‑resistant authentication methods, but understand their limits. FIDO2 security keys and Windows Hello for Business are strong against credential phishing, but a device‑code attack can still trick a user into authorizing the attacker’s session. Combine strong authentication with conditional access policies that require a compliant, managed device.
  5. Monitor identity signals closely. Look for:
    - Device‑code authentication events from unexpected locations or users.
    - Sign‑ins from IP addresses associated with hosting services or anonymizers shortly after a device joins a public network.
    - New OAuth app consent grants, inbox rules, forwarding addresses, or sudden OneDrive/SharePoint access.
  6. Audit your VPN and proxy logs. Ensure that no DNS leaks occur when the VPN is active, and block access to known malicious domains associated with this campaign (like those listed above).
  7. Have an incident response plan for mobile workers. When an employee reports a suspicious hotel Wi‑Fi experience, assume token theft, not just a password issue. Revoke active sessions in Entra, reset credentials, inspect mail rules, and check for new MFA enrollments.

Outlook: The Public Network as an Identity Battleground

This campaign exposes a hard truth: public Wi‑Fi is no longer just a privacy concern—it’s a direct identity threat. Any venue with a captive portal can become a staging ground for token theft. Hotels, airports, conference centers, co‑working spaces, hospitals, and apartment complexes all operate gateways that are often poorly maintained and easily compromised.

For hospitality operators, the findings are a wake‑up call. Captive portal appliances must be treated as internet‑facing security infrastructure: strong, unique admin credentials, MFA for management interfaces, firmware updates, and network segmentation are non‑negotiable.

For the rest of us, the practical takeaway is to stop trusting any network we don’t own. The era when you could hop on hotel Wi‑Fi, check a few emails, and be safe behind HTTPS is over. A managed Windows device with a full‑tunnel VPN, corporate DNS, strict proxy policies, and conditional access controls is the minimum bar for a mobile workforce handling sensitive data. Without that, every hotel stay becomes a roll of the dice for your Microsoft 365 account.