Researchers at ReliaQuest have identified an ongoing campaign, active since at least June, that hijacks DNS settings on Wi-Fi gateways at hotels and conference centers to steal Microsoft 365 credentials from traveling employees. Compromised gateways have been found in multiple U.S. cities as well as in India and Saudi Arabia.

Victim organizations span financial services, professional services, legal, health care, energy, and retail, indicating the attackers are targeting anyone connecting through affected networks rather than a specific industry.

ReliaQuest says the activity resembles the FrostArmada router-based campaigns previously attributed to the Russian espionage group APT28 (also known as Fancy Bear or Forest Blizzard), though attribution for this specific campaign was not confirmed.

How the Attack Works

It remains unclear how attackers first gain access to the Wi-Fi appliances, but ReliaQuest believes they may exploit weakly secured management interfaces such as SSH, SNMP, or web admin dashboards, or leverage unpatched vulnerabilities. Once administrative access is obtained, the attackers alter the gateway’s DNS settings so that requests to legitimate domains resolve to attacker-controlled infrastructure instead.

At least four phishing domains tied to the campaign have been identified: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. Victims attempting to reach the real Microsoft login portal are instead served convincing fake pages.

In some incidents, targets were funneled through a device-code authentication flow, prompted to approve what looks like a legitimate sign-in request. In reality, approving the prompt authorizes a session the attacker initiated, causing Microsoft to issue a valid OAuth token directly to the attacker’s client. This method bypasses MFA entirely without stealing passwords or intercepting tokens in transit.

In roughly a third of investigated cases, attackers also attempted to abuse Windows’ Web Proxy Auto-Discovery (WPAD) protocol by serving a malicious proxy auto-configuration file, potentially routing browser and app traffic through an attacker-controlled proxy. ReliaQuest could not confirm these WPAD attempts succeeded.

Notably, switching to public DNS resolvers like Google’s 8.8.8.8 does not stop the attack, since the compromised gateway forges plain-text DNS requests before they ever reach the intended resolver.

Recommended Protections

  • Use an always-on, full-tunnel VPN combined with encrypted DNS in strict mode
  • Disable WPAD where not required
  • Review network and authentication logs for suspicious activity
  • Disable Device Code authentication flow in Microsoft Entra ID unless actively needed