Hackers Hijack Hotel Wi‑Fi to Steal M365 Logins

How the Attack Worked

This campaign targeted hotel and hospitality Wi-Fi networks that use captive portals, the login pages guests see before getting internet access. Attackers manipulated traffic on these compromised networks to redirect guests toward two types of fake pages. The first mimicked a Microsoft sign-in screen, aiming to capture Microsoft 365 usernames and passwords the moment a traveler tried to reconnect to email or cloud services. The second presented a fake browser or operating system update notice, using ClickFix-style prompts that persuaded victims to download and run malware themselves rather than being infected through a traditional exploit.

Why It Succeeded

The attack succeeded by exploiting a moment of low suspicion. Travelers expect to see a login or verification screen after connecting to hotel Wi-Fi, so a fake Microsoft authentication page blended into that expected flow. Similarly, an update prompt appearing while browsing on unfamiliar network infrastructure did not immediately register as unusual to many users. Because the redirect happened at the network level rather than through a suspicious email or link, normal phishing instincts, like checking sender addresses, were less useful here.

Who Was Targeted

Corporate travelers and executives using Microsoft 365 appear to be the primary targets, with observed impact across multiple U.S. cities as well as India and Saudi Arabia. The campaign may also be expanding beyond Windows: some fake update pages directed Android users to install a malicious application, suggesting attackers are broadening their reach across device types.

What to Watch For

• A Microsoft login prompt appearing immediately and unexpectedly after joining hotel Wi-Fi
• A browser or operating system update request that appears mid-browsing session rather than through your device's normal update process
• Any prompt on a captive portal instructing you to download and install software to "continue" internet access
• Update or install instructions appearing on Android devices from a web page rather than an official app store

Building Resistance

Training should reinforce that Microsoft 365 logins and system updates should never originate from a hotel Wi-Fi captive portal. Employees should be encouraged to close unexpected login pages and navigate to Microsoft services manually, and to rely only on their device's built-in update mechanism or company IT tools. High-risk travelers, including executives, may benefit from additional protections such as a VPN or a managed hotspot instead of relying on venue Wi-Fi. Organizations that operate their own captive portal networks, including conference centers, co-working spaces, universities, healthcare facilities, and event venues, should also monitor for signs of traffic manipulation or unexpected redirects, since this campaign shows that such infrastructure itself can become a vector for credential theft and malware delivery.

How did attackers steal Microsoft 365 credentials through hotel Wi-Fi?

They compromised hotel and hospitality Wi-Fi networks that use captive portals and manipulated traffic to redirect guests to fake Microsoft login pages, capturing credentials as victims tried to authenticate.

What is the ClickFix technique used in this campaign?

Victims browsing on compromised hotel Wi-Fi were shown fake browser or operating system update pages that persuaded them to download and install malware themselves, a ClickFix-style social engineering approach.

Who is most at risk from this type of Wi-Fi hijacking attack?

Corporate travelers and executives using Microsoft 365 on hotel or other captive portal Wi-Fi appear to be the primary targets, though any organization operating captive portal networks, including airports, conference centers, and universities, could become a target.

Is this attack limited to Windows devices?

No, some of the fake update pages included instructions directing Android users to download and install a malicious application, suggesting the operation may be expanding beyond Windows computers.