Cybersecurity researchers have identified an ongoing campaign since at least June in which threat actors are compromising Wi-Fi gateways at hotels and conference centers to redirect users to malicious Microsoft 365 login pages. The campaign has impacted organizations across various sectors, including financial services, professional services, legal, healthcare, energy, and retail, suggesting a broad targeting of traveling employees.
ReliaQuest, a cybersecurity firm, confirmed the presence of compromised Wi-Fi gateways in multiple U.S. cities, as well as in India and Saudi Arabia. The researchers noted that these devices often serve corporate events, making the hijacking of Microsoft 365 accounts a significant threat for accessing sensitive business information, communications, and private documents. This activity bears similarities to the FrostArmada router-based campaigns previously attributed to the Russian espionage group APT28, also known as Fancy Bear or Forest Blizzard.
The initial method of gaining access to the Wi-Fi appliances remains unconfirmed, but ReliaQuest suggests attackers may be exploiting weakly secured or exposed management interfaces, such as SSH, SNMP, or web admin dashboards, or leveraging existing vulnerabilities. Once administrative access is achieved, the attackers modify the gateway's DNS settings to reroute connections intended for legitimate domains to infrastructure under their control.
The threat actors have registered at least four domains for their fake Microsoft login portals: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. When users attempt to access legitimate Microsoft login pages, the altered DNS settings direct them to these phishing sites, where they are prompted to enter their credentials.
In some instances, the researchers observed a device-code authentication flow. Targets were redirected to a fabricated Microsoft page displaying a prompt. Approving this prompt, unbeknownst to the user, authorizes a session initiated by the attacker, leading to the issuance of a legitimate OAuth token to the attacker's client. This method effectively bypasses multi-factor authentication (MFA) without requiring the theft of credentials or the interception of access tokens.
Approximately one-third of the investigated cases also involved attempts to exploit Web Proxy Auto-Discovery (WPAD). The attackers responded to Windows' automatic WPAD lookup with a malicious proxy auto-configuration (PAC) file, which theoretically could route traffic from Windows applications, including Chrome, through an attacker-controlled proxy. However, ReliaQuest could not confirm the success of these specific WPAD attacks.
The researchers emphasized that using public DNS servers, such as Google's 8.8.8.8, does not prevent this attack, as the compromised gateway forges plain-text requests before they can reach the intended resolver.
To mitigate these threats, ReliaQuest recommends implementing an always-on, full-tunnel VPN and utilizing encrypted DNS in strict mode. Additional recommendations include disabling WPAD, regularly reviewing logs for suspicious activity, and disabling the Device Code authentication flow in Microsoft Entra ID when it is not strictly necessary.
