Cyber Insight: Hotel Wi-Fi DNS Poisoning Campaign

Overview

Security researchers have uncovered an active campaign in which compromised hotel, conference centre and public Wi-Fi infrastructure is being used to steal Microsoft 365 credentials and authentication tokens.

Rather than targeting users through phishing emails or malicious attachments, the attackers compromise the network gateway itself. Once they gain administrative control of a captive portal or wireless authentication appliance, they can manipulate the Domain Name System (DNS) responses received by every device connected to that network.

Users attempting to access genuine Microsoft services are then redirected to convincing attacker-controlled login pages. Because the redirection happens at network level, victims may type the correct Microsoft address into their browser and still be sent to malicious infrastructure.

ReliaQuest has observed activity affecting travelling employees across financial services, healthcare, legal, energy, retail and professional services organisations. Victims have been identified in several countries, including the United States, India and Saudi Arabia.

The techniques resemble previous DNS hijacking operations linked to APT28, also known as Fancy Bear or Forest Blizzard. However, attribution remains uncertain, and researchers currently assess the connection with low-to-medium confidence.

What is DNS Poisoning?

DNS is responsible for translating familiar domain names, such as Microsoft’s web addresses, into the IP addresses used by computers to locate online services.

In a DNS poisoning attack, that translation process is manipulated. Instead of directing a user to the legitimate destination, the compromised DNS service provides an attacker-controlled address.

In this campaign, the attackers are not changing settings on individual laptops. They are altering the responses provided by the hotel or conference venue’s Wi-Fi gateway.

As a result, every device relying on that gateway’s DNS configuration may receive the malicious response automatically. The redirection can take place without the user installing software, opening an attachment or clicking a suspicious link.

How the Attack Works

The intrusion begins with the compromise of public Wi-Fi infrastructure. Attackers reportedly target exposed SSH services, SNMP management interfaces and web administration consoles, often relying on weak, reused or default administrator credentials.

Once access has been secured, the attackers modify DNS behaviour for devices connected to the network. Requests for Microsoft authentication services are redirected towards lookalike domains designed to imitate genuine Microsoft 365 login pages.

From there, the attackers may capture:

Microsoft account credentials
Session cookies
OAuth access tokens
Device Code authentication tokens

Stolen session information can be particularly valuable because it may allow the attacker to access a Microsoft 365 account without repeatedly asking the victim for a password.

This activity is best understood as an Adversary-in-the-Middle attack. The threat actor inserts malicious infrastructure between the user and the legitimate authentication service, allowing them to intercept or manipulate the login process.

Why This Matters

Public Wi-Fi has always carried an element of risk, but this campaign demonstrates how the threat extends beyond poorly secured wireless traffic.

The user may be visiting the correct website, using a corporate device and following normal login procedures. Nevertheless, a compromised gateway can interfere with the connection before endpoint security controls have an opportunity to respond.

This gives attackers several important advantages. There is no phishing email for a secure email gateway to block, no malicious executable for antivirus software to detect and no obvious suspicious link for the user to identify.

For travelling employees, the attack may be especially convincing. A Microsoft authentication prompt appearing shortly after connecting to hotel Wi-Fi is unlikely to appear unusual, particularly if the user is attempting to access Outlook, Teams, SharePoint or another cloud service.

Device Code Authentication Abuse

ReliaQuest also identified attempts to abuse Microsoft’s Device Code authentication process through the malicious domain ms365-live[.]com.

Device Code authentication is designed to help users sign into devices or applications that cannot easily display a conventional login interface. A user is presented with a code and asked to complete authentication on another device.
Attackers can misuse this workflow by persuading or redirecting victims into authorising a session controlled by the attacker. If successful, the resulting OAuth token may satisfy multi-factor authentication requirements and provide continued access to Microsoft 365 services.

This is important because changing the victim’s password may not be sufficient to terminate an attacker’s access. Previously issued tokens and active sessions may also need to be identified and revoked.

Microsoft has already highlighted Device Code phishing as a material identity threat. Organisations that do not require the feature should consider restricting or disabling it through Microsoft Entra ID Conditional Access policies.

WPAD Exploitation

Approximately one-third of the observed attacks also attempted to abuse Web Proxy Auto Discovery, commonly known as WPAD.

WPAD allows a device to automatically locate and apply network proxy settings. Attackers can misuse this functionality by supplying a malicious Proxy Auto-Configuration file through DHCP Option 252.

If the device accepts those settings, browser and application traffic may be routed through attacker-controlled proxy infrastructure. This provides another opportunity to inspect, redirect or manipulate Microsoft 365 authentication traffic.

Because WPAD can operate automatically, users may have no indication that their network configuration has changed.
Where it is not operationally required, organisations should disable WPAD on managed devices and monitor for unexpected PAC file downloads or proxy configuration changes.

Why Common DNS Protections May Not Be Enough

Some organisations attempt to reduce DNS risk by configuring devices to use public resolvers such as Google DNS or by enabling opportunistic DNS-over-HTTPS or DNS-over-TLS.

ReliaQuest warns that these measures may not reliably stop this campaign.

If a device is still permitted to fall back to unencrypted DNS, a compromised gateway may intercept or force that fallback traffic. Opportunistic encryption improves security where supported, but it does not guarantee that every DNS request remains protected.

The configurations reported to provide the most consistent protection are:

An always-on, full-tunnel corporate VPN
Strict encrypted DNS with unencrypted fallback disabled

A full-tunnel VPN routes all network traffic through the organisation’s trusted infrastructure, reducing the ability of a hostile local gateway to influence DNS or authentication traffic.

Detection & Monitoring Recommendations

Security teams should look for Microsoft 365 authentication events that occur shortly after users connect from hotels, airports, conference venues or other public networks.

A sign-in that appears geographically plausible should not automatically be considered legitimate. Attackers may use local hosting infrastructure or residential proxy services to make activity appear consistent with the user’s travel location.

Useful indicators include:

Microsoft authentication domains resolving to unexpected IP addresses
Device Code authentication attempts
Unusual OAuth token issuance
Newly registered Entra ID devices
Sign-ins from anomalous locations
Impossible travel alerts
WPAD requests or unexpected PAC file downloads
Suspicious account activity shortly after public Wi-Fi use

Organisations should also hunt for connections to the following reported infrastructure:

Domains

m365-owa[.]com
owa-ms365[.]com
ms365-device[.]com
ms365-live[.]com

IP addresses

38.146.28[.]75
31.57.243[.]154
104.194.159[.]150

Associated email address

chikolimdrid[at]gmail[.]com

Any account linked to this infrastructure should be investigated for token theft, session hijacking and unauthorised access.

Recommended Actions

Organisations with employees who travel regularly should prioritise the deployment of an always-on, full-tunnel VPN across all managed corporate laptops.

VPN enforcement should begin before users access cloud applications, rather than relying on employees to activate the connection manually after joining public Wi-Fi.

Encrypted DNS should also be configured in strict mode, with plaintext DNS fallback disabled wherever possible. WPAD should be removed or restricted where there is no clear business requirement.

Identity controls are equally important. Security teams should review Device Code authentication usage, strengthen Microsoft Entra ID Conditional Access policies and monitor for suspicious OAuth application consent or token creation.
Where compromise is suspected, defenders should revoke active sessions, invalidate refresh tokens, reset affected credentials and investigate any newly enrolled devices or altered authentication methods.

Phishing-resistant MFA, such as FIDO2 security keys or passkeys, can further reduce the value of credentials captured through fraudulent login pages.

Analyst Assessment

The campaign represents a significant development in Microsoft 365 account compromise because it removes phishing from the initial attack altogether.

Users do not need to click a malicious link or open an infected document. They only need to connect to compromised Wi-Fi infrastructure and attempt to access a legitimate cloud service.

Although the potential link to APT28 remains unconfirmed, the attack methodology is consistent with previous state-aligned DNS hijacking activity. The focus on OAuth tokens, Device Code authentication and session theft also demonstrates how threat actors are adapting to environments where multi-factor authentication is widely deployed.

For organisations with travelling staff, always-on VPN enforcement, strict encrypted DNS, stronger Conditional Access policies and continuous Microsoft 365 authentication monitoring should now be considered fundamental controls.

How NormCyber MDR Helps Protect Microsoft 365 Accounts

Identity attacks do not always begin with a phishing email or malicious file. As this campaign demonstrates, credentials and session tokens can be stolen through infrastructure that sits entirely outside an organisation’s direct control.

NormCyber’s Managed Detection and Response service continuously monitors identity, endpoint and network telemetry to identify suspicious activity affecting Microsoft 365 and Microsoft Entra ID environments. Our analysts investigate anomalous sign-ins, unusual OAuth token issuance, unfamiliar device registrations, impossible travel events and changes to account authentication methods.

By correlating Microsoft 365 activity with endpoint and network signals, NormCyber can help distinguish legitimate employee travel from potentially compromised sessions. Where suspicious access is detected, our SOC can support rapid containment measures, including session revocation, credential resets and further investigation into the affected account.

Continuous monitoring is particularly important in attacks of this nature because the earliest visible evidence may only appear after the attacker has already obtained a valid cloud session.