Hacked Wi‑Fi Portals Steal M365 Logins

How the attack worked

This campaign targeted the moment employees are most vulnerable: connecting to Wi-Fi in an unfamiliar hotel, conference center, or shared venue. Attackers manipulated DNS and HTTP traffic within captive portal networks, redirecting users away from the legitimate Wi-Fi login page toward attacker-controlled infrastructure. From there, the operation used adversary-in-the-middle techniques to intercept Microsoft 365 credentials as victims tried to sign in.

The redirected pages presented two main lures. One claimed the user's browser needed an update to get online, which actually delivered a Golang-based Windows remote access trojan, or tried to entice Android users into installing a malicious APK using ClickFix-style prompts. The other pushed a Microsoft device code authentication flow, asking victims to enter a code into a legitimate-looking Microsoft sign-in page, which in reality authorized the attacker's own session.

Why it succeeded

The attack exploited trust in an everyday routine. Travelers expect to click through a Wi-Fi login page before getting online, so a prompt to "update your browser" or authenticate a session did not feel unusual. Embedding the phishing inside the captive portal itself, rather than sending a separate suspicious email, increased the likelihood that users would perceive the requests as a normal part of connecting to the network rather than as an attack.

What to watch for

• A Wi-Fi login page asking you to install or update software before you can get online
• An unexpected APK download prompt on Android while joining venue Wi-Fi
• A device code sign-in request you did not initiate on another device
• Authentication prompts that appear immediately after connecting to public Wi-Fi rather than through your normal corporate login flow

Building resistance

Employees who travel, along with executives, sales, consultants, finance, legal, and healthcare staff, should treat public Wi-Fi portals as untrusted by default. Corporate credentials should never be entered into a captive portal page, and no browser update or app install should ever be accepted from one. If a device code prompt appears unexpectedly, the safest move is to stop and report it rather than complete the sign-in, since it may hand an attacker control of an active session. Building this habit into travel security awareness reduces the chance that a routine hotel or conference Wi-Fi connection turns into a credential theft incident.

How did attackers use public Wi-Fi portals to steal credentials?

They manipulated DNS and HTTP traffic from captive portal networks at hotels, conference centers, and shared venues to redirect users to attacker-controlled pages, then used adversary-in-the-middle techniques to intercept Microsoft 365 credentials.

What is the device code sign-in trick used in this campaign?

Some landing pages directed victims to Microsoft's device code authentication flow, instructing them to enter a code into a real Microsoft sign-in page, which authorized the attacker's session instead of the user's.

What malware was delivered through fake browser updates?

The campaign served Golang-based Windows remote access trojans disguised as browser updates and used ClickFix-style prompts to get Android users to install a malicious APK.

Who is most at risk from this type of attack?

Traveling employees, executives, sales staff, consultants, and anyone using Microsoft 365 on public Wi-Fi at hotels, conference centers, or shared venues are the primary targets.