Business travelers do the same thing without thinking about it. Check into the hotel, open the laptop, tap the network name from the list, type in a room number or a last name, and get back to work. That habit is exactly what a new wave of attacks is counting on. Security researchers have found that hotel and conference center Wi-Fi networks in multiple countries have been quietly hijacked to steal Microsoft 365 logins from the very people who trust that connection most: employees on the road.
What makes this campaign worth paying attention to is not just who it is hitting, but how little it asks of the victim. There is no phishing email to fall for, no attachment to open, and no malware to install. The trap is built into the network itself, and by the time a laptop connects, the damage is already in motion.
The Attack Lives in the Router, Not Your Inbox
Researchers at ReliaQuest and Microsoft have been tracking compromised Wi-Fi gateways across hotels and conference venues in the United States, India, and Saudi Arabia since at least June 2026. The entry point is mundane: many of these properties run small office and home office grade routers to handle guest Wi-Fi, and those devices often ship with exposed management interfaces such as SSH, SNMP, or a web admin panel, sometimes still sitting behind default or reused passwords. Once an attacker gets administrative access to one of these gateways, they do not need to touch a single guest device directly. They just change the DNS settings.
That single change is what makes the attack so effective. A Wi-Fi gateway handles DNS lookups for every device that connects to it, translating a typed address into the server it actually reaches. Poison that lookup table, and a guest can type “microsoft.com” into their browser with perfect accuracy and still land on a server the attacker controls. The address bar shows nothing wrong, because nothing about the request itself is wrong. Only the destination has quietly changed hands.
Skipping the Password Entirely
Once a guest’s traffic is being redirected, the attackers do not simply throw up a fake login box and hope someone types a password into it, though that has been part of the campaign too, using lookalike domains such as m365-owa.com, owa-ms365.com, and ms365-live.com to mimic genuine Microsoft sign-in pages. The more concerning technique researchers flagged is narrower and harder to spot: abuse of Microsoft’s device code authentication flow.
Device code login exists for a legitimate reason. It lets someone sign into a Microsoft account on a device with no keyboard or browser, a smart TV or a conference room console, by generating a short code that gets approved from a phone or laptop that is already logged in. Attackers have been exploiting that flow by prompting a hijacked session to generate a device code request, then getting the victim to unknowingly approve it. The victim never hands over a password. They just click approve on something that looks like a routine sign-in prompt, and the attacker walks away with a valid OAuth token, enough to access the account without needing a password or a one-time code at all. It is a textbook example of how multi-factor authentication, while still worth having, is not the finish line security teams sometimes treat it as.
Familiar Fingerprints Point to a Familiar Actor
The tradecraft here is not new so much as it is recycled and refined. Investigators say this campaign carries strong hallmarks of FrostArmada, a set of activity previously linked to APT28, also tracked under the names Forest Blizzard and Fancy Bear, a military intelligence unit widely attributed to Russia’s GRU. Gateway-level DNS hijacking, domains built to impersonate Microsoft’s login infrastructure, and a downstream adversary-in-the-middle style compromise of Microsoft 365 accounts all line up with tactics this group has used before against routers and edge devices. What has changed is the target list. Instead of picking off known offices or specific individuals, this version goes after the physical spaces where corporate employees briefly let their guard down, hotel lobbies, conference centers, the kind of shared, semi-public network everyone assumes is safe enough for checking email.
The victim list reflects that shift in strategy. Confirmed and suspected targets span financial services, legal, healthcare, energy, retail, and professional services firms, spread across multiple U.S. cities as well as locations in India and Saudi Arabia. None of that requires a targeted spear-phishing email tailored to one employee. It just requires that employee to book a hotel room in the wrong building during the wrong week.
Why This Keeps Happening at the Network Level
It is tempting to treat this as a hotel industry problem, but the honest read is broader than that. Hospitality Wi-Fi has always been an awkward mix of convenience and neglect. Properties want guests online in seconds with no friction, so captive portals are simple by design, and the routers behind them are frequently installed once and left alone for years, patched rarely if ever. That combination, wide deployment plus weak maintenance, is exactly the profile a state-linked group looks for when it wants a foothold that can sit quietly for months. It also echoes a pattern security teams have been noticing across other everyday infrastructure lately, from smart building systems to license plate readers that are being quietly upgraded into far more capable tracking tools, where equipment nobody thinks of as a security asset ends up handling a surprising amount of sensitive traffic and data.
What Actually Stops This
For IT and security teams, the single most effective fix is not user training, it is a configuration change. Microsoft Entra Conditional Access supports an authentication flows condition that can block the device code grant entirely for users who have no genuine business need for it, which describes the overwhelming majority of a typical workforce. Where the flow is genuinely required, restricting it to trusted networks and locations closes most of the gap. Security teams should also treat any suspected compromise as more than a password reset, since an attacker holding a valid OAuth token keeps working even after the password changes, until sessions are explicitly revoked.
Business travelers have a simpler, if less complete, set of options. A trustworthy VPN encrypts and reroutes traffic before a compromised gateway ever gets a chance to redirect it, which neutralizes DNS poisoning at the source. It is also worth treating any unexpected device code prompt, especially one that appears without you having just tried to sign into a TV, kiosk, or similar screen, as a red flag rather than a routine click. None of this requires becoming a security expert. It just requires knowing that the free Wi-Fi at check-in is no longer the safest weak link in the chain, the router quietly running it might be.
Microsoft’s own security calendar this year has already been unusually heavy, including a record-setting Patch Tuesday that fixed 570 vulnerabilities in a single release, a reminder that the volume of both offense and defense in this space keeps climbing. Industry responses are shifting too. Telecom carriers facing their own run of state-linked intrusions recently broke years of competitive habit to form a joint threat-sharing group, eight rival companies pooling intelligence through the new C2 ISAC, which suggests more industries may need that same kind of coordinated defense as attackers keep finding ordinary infrastructure to exploit. Hospitality could well be next in line.
