Hotel DNS Attacks: Corporate VPNs Aren't Enough to Protect…

ReliaQuest has documented an active campaign since June 2026 that compromises hotel Wi-Fi gateways to redirect Microsoft 365 logins to fake pages. The technique bypasses both passwords and MFA using OAuth device code flow, and standard defenses like public DNS and opportunistic DoH fail because the gateway intercepts traffic in plaintext before it reaches any external resolver.

ReliaQuest Threat Research disclosed on July 24, 2026, a campaign compromising hotel and conference-center Wi-Fi gateways to intercept Microsoft 365 logins. The operation has been active since at least June 2026 across at least three countries and hits six industry verticals, with a technical variant that renders both passwords and multi-factor authentication ineffective.

Key Takeaways

ReliaQuest tracked compromised Wi-Fi gateways in U.S. cities, India, and Saudi Arabia, with victims in the financial, legal, healthcare, energy, professional-services, and retail sectors.
Attackers use DNS poisoning on captive-portal appliances to redirect Microsoft requests to malicious domains: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, ms365-live[.]com.
In a subset of cases, the OAuth device code flow bypasses MFA without stealing passwords: the victim enters a code generated by the attacker's device at microsoft.com/devicelogin, and Microsoft issues a valid token to the adversary's client.
Standard protections — public DNS such as 8.8.8.8 and opportunistic DNS over HTTPS/TLS — do not stop the attack because the compromised gateway intercepts plaintext traffic before it reaches any external resolver.

How the Captive-Portal Trap Works

The attack exploits the man-in-the-middle position the Wi-Fi gateway occupies by definition. When a guest connects to the hotel network, the captive-portal appliance controls DNS resolution for all devices. Attackers who have gained administrative access to the gateway alter DNS responses for Microsoft domains: login.microsoftonline.com and related endpoints resolve to adversary-controlled servers instead of Microsoft's real infrastructure.

The malicious page replicates the Microsoft 365 login interface with enough fidelity to harvest credentials. But ReliaQuest documented a second, more insidious mode that does not require password theft. The attacker generates a device code flow code on their own client, then lures the victim to microsoft.com/devicelogin — Microsoft's authentic page — and has them enter that code. As TechTimes reported, citing ReliaQuest: "Multi-factor authentication was not defeated; it was used correctly — against the victim."

The mechanism is technically legitimate: device code flow is an OAuth 2.0 path designed for keyboardless devices. Microsoft has recognized it as a high-risk vector since 2021 and recommends blocking it via Conditional Access. That recommendation remains widely ignored.

Why Standard Defenses Fail

The campaign exposes a gap between theoretical awareness and practical implementation. Many companies advise traveling employees to use public DNS like 8.8.8.8 or enable DNS over HTTPS/TLS. According to ReliaQuest, both countermeasures fall short against this specific scenario.

The compromised gateway intercepts plaintext DNS requests before they reach any external resolver. Even opportunistic DNS over HTTPS/TLS fails: the gateway can interfere with the cryptographic handshake, forcing a fallback to cleartext communications that remain vulnerable to poisoning. As SecurityAffairs summarized, citing ReliaQuest, "Two configurations do stop it": full-tunnel VPN, which routes all DNS traffic through the corporate tunnel before the gateway can touch it, and DNS over HTTPS/TLS in strict mode with no plaintext fallback.

The problem is that most enterprise VPNs use split tunneling to reduce load on the corporate network. In that configuration, DNS traffic for cloud services — Microsoft 365 included — exits directly through the local gateway, exposing it to manipulation.

WPAD and the Attackers' Command Panel

ReliaQuest observed attempts to abuse the Web Proxy Auto-Discovery (WPAD) protocol in roughly one-third of analyzed cases. The gateway responds to WPAD queries with a malicious PAC file that redirects traffic through attacker-controlled proxies. The actual success of this maneuver is unconfirmed: attempts are documented, but ReliaQuest has not verified that proxy interception proved productive.

More significant is the discovery of a management panel on the attacker domain, with staging, lure rotation, telemetry, and IP allowlist capabilities. This indicates a structured, ongoing operation, not an opportunistic exploit. Initial access to the gateways is assessed with "low-to-medium confidence" as the result of exposed management interfaces — SSH, SNMP, web admin panels — protected by weak or reused credentials, but ReliaQuest has not confirmed this vector.

Comparison with FrostArmada and Attribution Limits

The techniques documented by ReliaQuest echo a previous campaign, known as FrostArmada and associated with APT28, which between March and April 2026 compromised roughly 18,000 SOHO routers for DNS hijacking toward fake Microsoft portals. The differences are decisive: FrostArmada hit residential and small-office gear (MikroTik, TP-Link), not hotel gateways; used selective DNS redirection, while this campaign employs total redirection; and operated at a numerically different scale.

"not currently assessed to be FrostArmada itself, but shares enough tactics, techniques, and procedures to suggest tradecraft reuse at a minimum" — ReliaQuest Threat Research

The operators' identity remains unknown. No infrastructure overlaps link the actor to known attributed groups at this time, and the exact number of victims or compromised accounts is not quantified in available sources.

What to Do Now

Disable OAuth device code flow via Microsoft Conditional Access, following the recommendation Microsoft has issued since 2021 for enterprise environments.
Shift enterprise VPNs from split tunneling to full-tunnel for traveling employees, so all DNS requests — not just those for internal resources — traverse the protected corporate infrastructure.
Configure DNS over HTTPS/TLS in strict mode on managed mobile devices, eliminating the plaintext fallback that a compromised gateway can exploit to force connection degradation.
Disable WPAD on managed corporate systems, removing an auto-discovery proxy vector that ReliaQuest documented as actively probed in this campaign.

The Business Traveler's Paradox

The ReliaQuest campaign reveals a risk category that standard corporate policies do not effectively cover. No click on a suspicious link is required, no malicious attachment needs opening: simply connecting to an apparently legitimate network and following the correct authentication procedure on Microsoft's authentic pages hands the attacker an MFA-validated token. Implicit trust in hospitality infrastructure — hotels, conference centers, airport lounges — becomes the entry point.

Mitigations exist and have been documented for years. That most organizations have yet to implement them suggests a governance problem more than a knowledge gap: the divide is not over what to do, but over who is responsible for doing it when the perimeter extends to networks the company does not control.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references