Hotel Wi-Fi DNS Poisoning Attacks Hijack Microsoft 365 Accounts

A live credential-harvesting campaign has turned guest internet access into an attack surface. Researchers tracking hotel Wi-Fi DNS poisoning have found compromised gateways in multiple US cities, India and Saudi Arabia, most of them run by hotels and hospitality operators. Victims never click a phishing link. They connect to the network, open a browser and land on a fake Microsoft 365 sign-in page.

Traffic to those gateways came from firms in financial services, law, healthcare, energy and retail, which points away from sector-specific targeting. Corporate travelers connecting to hotel Wi-Fi remain the intended targets of this DNS poisoning operation, wherever their work takes them. Activity has continued since at least June 2026.

How hotel Wi-Fi DNS poisoning works

Captive portal appliances sit at the edge of every guest network. They assign addresses, route traffic and answer DNS queries for each device that joins. Control of one appliance gives an attacker control over what every guest sees.

Initial access appears to come through exposed management interfaces. Internet-facing SSH, SNMP and web administration consoles, paired with weak or reused admin passwords, offer a straightforward route in. Researchers rate that assessment at low to medium confidence, because visibility into the devices stayed limited.

The attacker then rewrites the gateway configuration. Queries for legitimate domains return attacker-owned IP addresses instead. Anyone who joins a hotel Wi-Fi network can meet DNS poisoning without making a single mistake, because the gateway answers every request before it reaches the internet.

Why standard DNS protections fail

Many people assume a hard-coded public resolver keeps them safe. It does not. A query sent to 8.8.8.8 still leaves the laptop as plaintext traffic, and the gateway can read it, forge a reply and send the user somewhere else.

Encrypted DNS helps only under strict configuration. Most tools default to opportunistic mode, which falls back to plaintext when encrypted resolution fails. That fallback is what a poisoned gateway intercepts. Hotel Wi-Fi DNS poisoning succeeds against machines their owners believe are protected.

Two setups stop the attack outright. Strict-mode DNS over HTTPS or DNS over TLS removes the plaintext fallback. A full-tunnel VPN sends every request, DNS included, through the corporate network before the gateway ever sees it.

A second channel through WPAD

In roughly a third of observed cases, the attacker also reached for Web Proxy Auto-Discovery. WPAD lets Windows fetch proxy settings automatically when a device joins a network, and it checks both DHCP and DNS. A gateway attacker controls both.

A successful WPAD hijack pushes a malicious proxy configuration file onto the machine. Chrome, core authentication components and most enterprise applications then route through the attacker's proxy. The resulting traffic logs resemble ordinary HTTPS connections, which makes the activity easy to overlook.

Researchers could not confirm success here, so the technique looks opportunistic rather than central. WPAD widens the reach of hotel Wi-Fi DNS poisoning beyond authentication traffic alone.

Device-code abuse defeats MFA

Some victims faced a quieter route to account takeover. Rather than collect a password on a fake page, the attacker paired the redirect with abuse of Microsoft's device-code authentication flow.

The victim sees what looks like a routine Microsoft sign-in prompt. Approving it authorizes a session the attacker started. Microsoft then issues valid OAuth tokens to attacker-controlled software, and the attacker walks into the account with multifactor authentication already satisfied.

No credentials change hands at any point. This path makes hotel Wi-Fi DNS poisoning dangerous even for accounts behind strong MFA. Password resets do not reliably end the access either, since attacker-enrolled devices can outlast them.

Tradecraft points toward Russian intelligence

The methods overlap with FrostArmada, a campaign disrupted in April 2026 that altered DNS settings on small office and home office routers to steal Microsoft logins and OAuth tokens. Analysts attributed that operation to APT28, also known as Fancy Bear and Forest Blizzard, a group linked to Russian military intelligence.

The overlap stops short of attribution. Domains and IP addresses in the current campaign do not match known APT28 infrastructure. The operator also redirected every DNS query rather than filtering by keyword, a blunt approach that suggests a less careful hand.

One attacker domain hosted an operator panel with page rotation, visitor tracking and IP allow listing. Those cloaking features indicate an operation still under active maintenance.

Defending against hotel Wi-Fi DNS poisoning

One control removes most of the exposure. Always-on VPN with a full-tunnel configuration pushes all traffic through trusted corporate resolvers before the gateway can interfere. Split-tunneling exceptions undo that protection, so security teams should audit and remove them.

Supporting measures close the remaining gaps. Disabling WPAD through Group Policy eliminates one channel where automatic proxy discovery serves no purpose. Blocking the device-code flow in Microsoft Entra ID through Conditional Access removes another, and few users have a legitimate reason to need it.

Monitoring matters as well. Proxy authentication logs showing sign-ins from unfamiliar hosts point to credential harvesting through a rogue proxy. Staff training still helps, because checking a URL and certificate before entering a password remains a practical habit.

The travel risk has changed

Guest networks have carried risk for years, but the assumption held that careless users caused the damage. Hotel Wi-Fi DNS poisoning removes user error from the equation. A single compromised gateway exposes every guest on that network for as long as it stays under attacker control.

The problem reaches well past hotels. Airports, conference centers, co-working spaces, universities, healthcare facilities and event venues all run captive portals with the same structural weakness. Any organization sending staff on the road should treat public gateways as hostile and configure devices before the trip starts.