Hotel Wi‑Fi Redirect Scam Steals Microsoft 365 Logins

How the attack worked

This campaign targets the network infrastructure that business travelers rely on rather than their inboxes. Attackers gain access to hotel or conference center Wi-Fi gateway and captive portal equipment, frequently through weak or default passwords. Once inside, they alter the gateway's DNS settings. When a guest connects to the public Wi-Fi and tries to reach Microsoft 365 services, the compromised gateway resolves the request to a malicious IP address instead of the legitimate one, routing the victim to a fraudulent phishing site built on a lookalike domain such as m365-owa[.]com.

Why it succeeded

The redirection happens at the network level rather than on the user's device, so traditional email security tools and some endpoint defenses may never see it. There is no phishing email to flag, no suspicious attachment, and no obvious link to inspect, because the malicious redirect is baked into the network path itself. Victims who enter their Microsoft 365 username and password on the fake page may also expose authenticated session tokens, which attackers can use to bypass multi-factor authentication through adversary-in-the-middle techniques. ReliaQuest assessed this tradecraft as similar to techniques previously linked to APT28 (Fancy Bear), reflecting a level of sophistication rated high.

Who is at risk

The technique is broadly aimed at anyone who travels for work, but it carries particular weight for executives, finance, legal, healthcare staff, sales teams, and frequent travelers, along with IT and identity and access management personnel who manage corporate credentials. Affected industries extend beyond hospitality itself to banking, legal services, and healthcare, since employees from these sectors regularly connect to hotel and conference Wi-Fi while traveling.

What to watch for

• A Microsoft 365 sign-in page appearing on an unfamiliar or lookalike domain instead of the normal corporate or Microsoft domain
• A login prompt that appears immediately after joining public Wi-Fi and looks different from the usual sign-in experience
• Public Wi-Fi infrastructure requesting credentials for a corporate service at all

Building resistance

Organizations should treat public Wi-Fi as untrusted by default and train travelers not to enter Microsoft 365 credentials if a sign-in page's domain looks unusual. Because this attack bypasses inbox-based controls entirely, awareness training should emphasize that credential theft can occur without any email involved. Mandating always-on, full-tunnel VPNs for staff devices helps ensure DNS queries and web traffic route through reliable corporate infrastructure rather than depending on potentially compromised public networks. Finally, users should understand that MFA alone is not a guarantee of safety if session tokens are captured, and should report suspicious sign-in prompts quickly.

How does the hotel Wi-Fi Microsoft 365 scam work?

Attackers compromise hotel or conference center Wi-Fi gateways, often through weak or default passwords, then change DNS settings so guests trying to reach Microsoft 365 are silently redirected to fraudulent phishing websites on lookalike domains such as m365-owa[.]com.

Can this attack bypass multi-factor authentication?

Yes. Stolen data may include authenticated session tokens, which attackers can use to bypass MFA through adversary-in-the-middle techniques.

Why does email security fail to catch this attack?

The redirection happens at the network level rather than on the user's device, so traditional email security solutions and some endpoint defenses can miss it entirely.

How can travelers protect themselves on public Wi-Fi?

Organizations can mandate always-on, full-tunnel VPNs so DNS queries and web traffic route through corporate infrastructure instead of relying on potentially compromised public Wi-Fi networks.