Hotel Wi‑Fi DNS Scam Steals Microsoft 365 Logins

How the attack worked

This campaign begins at the network level rather than in an inbox. Attackers gain administrative access to Wi-Fi gateways at hotels and conference centers and modify DNS configurations so that connected devices are pointed toward look-alike domains instead of legitimate Microsoft services. Because the redirection happens at the gateway, the malicious sign-in page can appear immediately after a traveler joins the network, often before they have any reason to be suspicious.

Once on the fake page, victims are guided through a device-code authentication flow. Instead of typing a password into an obvious clone, they are prompted to enter a code shown on screen to "continue signing in." Completing this step actually authorizes an attacker-initiated session, and the attacker receives a legitimate OAuth token, one that bypasses multi-factor authentication entirely because the victim technically completed a valid, if manipulated, authentication step.

The actors have also attempted to abuse Web Proxy Auto-Discovery (WPAD) with malicious proxy auto-configuration files, giving them another path to route victim traffic through infrastructure they control.

Why it succeeded

Several conditions make this scenario effective:

• The redirection happens automatically at the network layer, so there is no suspicious email or link for a user to scrutinize.
• A Microsoft 365 sign-in page feels routine, especially for traveling employees who expect to re-authenticate on new networks.
• Device-code flows are a legitimate part of some sign-in experiences, so an unexpected prompt does not immediately read as unusual to most users.
• Using a public DNS resolver alone does not fully protect users, since a compromised local gateway can forge plaintext DNS responses before a request ever reaches a public resolver.

What to watch for

• Sign-in pages that appear unexpectedly right after connecting to hotel or conference Wi-Fi.
• Login domains that are not genuine Microsoft domains, including subtle look-alike spellings.
• Device-code prompts appearing when you did not deliberately start that kind of sign-in.
• MFA steps that feel different from your normal routine or are not tied to an action you took.

How to build resistance

Organizations should enforce always-on, full-tunnel VPNs for traveling staff, use encrypted DNS in strict mode, disable WPAD where it is not needed, and disable the device-code authentication flow in Microsoft Entra ID where it is not required for business use. Employees should be trained to treat unexpected sign-in pages and device-code prompts on public Wi-Fi as suspicious, verify the web address before entering credentials, and report unapproved authorization requests rather than completing them.

How does the hotel Wi-Fi Microsoft 365 scam work?

Attackers compromise hotel and conference Wi-Fi gateways and change DNS settings so travelers are silently redirected to fraudulent Microsoft 365 login pages instead of the real service.

Can this attack bypass multi-factor authentication?

Yes. Victims are tricked into completing a device-code authentication flow that authorizes an attacker-initiated session, producing a legitimate OAuth token that bypasses MFA.

What red flags should travelers watch for?

Watch for sign-in prompts appearing unexpectedly right after joining public Wi-Fi, unfamiliar login domains, and device-code prompts you did not initiate yourself.

What can organizations do to reduce risk?

Enforce always-on, full-tunnel VPNs, use encrypted DNS in strict mode, disable WPAD, and disable the device-code authentication flow in Microsoft Entra ID.