The Hotel Wi-Fi Took Your Microsoft 365 Account and Never Sent You an Email

Every awareness training you have ever sat through taught the same tell: look for the suspicious email. Check the sender. Hover the link. Do not click.

This campaign never sends an email.

ReliaQuest published research this week on threat actors compromising the captive portal appliances that run guest Wi-Fi at hotels and conference centers, then poisoning DNS at the gateway so that a guest typing a perfectly legitimate Microsoft address gets served an attacker's login page instead. No phishing email. No attachment. No malware on the endpoint. Nothing to hover over, because the address bar is right.

Active since at least June 2026. Compromised appliances found at venues across multiple US cities, plus India and Saudi Arabia. Victim traffic came from finance, healthcare, legal, energy, retail, and professional services.

Why this beats the training and the MFA

The user does everything correctly. They open a browser on hotel Wi-Fi, go to their mail, get a Microsoft-looking sign-in prompt at what appears to be the right destination, and sign in. Every instinct the training built points at the email, and there is no email.

The multi-factor angle is worse. The reporting describes account takeover that does not require stealing a credential or intercepting a token, using techniques including the device-code authentication flow. Device code is a legitimate Microsoft feature built for input-constrained devices — a TV, a conference room display. The user is shown a short code and told to enter it at a real Microsoft URL. They authenticate for real, against the real Microsoft, with their real MFA. And the session lands in the attacker's hands, because the attacker is the device that requested it.

Nothing was bypassed in a technical sense. MFA worked exactly as designed. It just verified the wrong thing — that the human was who they said they were, which was never in question, rather than that the session they were approving belonged to them.

ReliaQuest assesses low-to-medium confidence on tradecraft overlap with APT28, the Russian military intelligence group also tracked as Fancy Bear and Forest Blizzard. They are explicit that this rests on technique overlap and not on shared infrastructure, code reuse, or an operator OPSEC failure. That is a careful attribution and we are going to repeat it as carefully as they made it.

The indicators

Three IP addresses: 38.146.28.75, 31.57.243.154, 104.194.159.150.

Four domains built to read as Microsoft at a glance on a phone: m365-owa.com, owa-ms365.com, ms365-device.com, ms365-live.com. That third one is the device-code flow announcing itself in the registration.

We checked all seven against our corpus before writing this. None were present. We were not ahead of ReliaQuest here and we are not going to imply otherwise. They are going into our feed now with attribution, which puts them in a free blocklist for the many organizations that will never buy a ReliaQuest subscription.

The one control that actually closes this

Always-on, full-tunnel VPN on corporate devices.

That is it. That is the whole mitigation and it is unusually clean. Full-tunnel means every packet, including DNS, goes to your corporate resolver before it touches the hotel gateway. The poisoned DNS server never gets asked the question, so it never gets to lie.

Split-tunnel does not save you. Split-tunnel exists specifically to let some traffic take the local path, and DNS is very often on the local side of that split for latency reasons. If your VPN config sends DNS to the local resolver, you are still exposed while feeling protected — which is the worst configuration to be in, because it buys confidence it did not earn.

Also worth doing:

Block the device-code authentication flow in your Entra ID conditional access policy unless you have a documented need for it. Most organizations have none. It is one of the highest-leverage policy toggles available and almost nobody has thrown it.

Disable WPAD by Group Policy where it is not needed. Same class of problem, longer history.

Tell your travelling staff to tether. Phone hotspot over hotel Wi-Fi, always, and it costs nothing. This is the single most useful sentence to put in front of a sales team or an executive before a conference.

Audit proxy authentication logs for sign-ins from hospitality netblocks in cities where you had people on the road.

Why we care about this one specifically

Our whole reason for existing is coverage for organizations that cannot afford the vendors — the clinic, the county, the small manufacturer, the firm with one IT person who is also the person who fixes the printer.

Those organizations send people to conferences. They almost never have full-tunnel VPN, because full-tunnel VPN is an expensive posture to run well. And they are exactly the target profile in ReliaQuest's victim sectors: finance, healthcare, legal, professional services.

So the practical advice for that reader is not the enterprise answer. It is the cheap one. Tether. Use your phone. If you must use the venue Wi-Fi, do not sign into anything corporate on it, and if a sign-in page appears when you did not expect one, close the laptop.

We are 95 percent confident this technique spreads well beyond whoever is running it now, because the hard part — finding vulnerable captive portal appliances — is a scanning problem, and scanning problems always get commoditized. The five percent is the chance that hospitality Wi-Fi vendors push firmware fast enough to shrink the pool first. They have not historically.

Indicators ingested with attribution to ReliaQuest Threat Research. Free blocklists at analytics.dugganusa.com.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com