Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials
Threat actor hacks public Wi-Fi gateways to steal Microsoft 365 credentials from traveling corporate employees.
A threat actor has been compromising public Wi-Fi gateway appliances at hotels, conference centers, and other shared venues across the US, India, and Saudi Arabia to target Microsoft 365 accounts of traveling corporate employees. The attackers modified DNS configurations to redirect users to attacker-controlled infrastructure for credential harvesting using adversary-in-the-middle (AitM) techniques. The campaign, ongoing since at least June 2026, shares similarities with the FrostArmada campaign attributed to APT28 (Forest Blizzard/Fancy Bear), though infrastructure and targeting methods differ, suggesting either a copycat actor or a related group using similar tradecraft.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ReliaQuest?
Get an email when a new story names ReliaQuest, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised public Wi-Fi gateway appliances at hotels and conference centers, modifying DNS configurations to silently redirect corporate travelers to attacker-controlled phishing infrastructure — a classic Adversary-in-the-Middle (AitM) attack. The root cause is a combination of poorly secured network appliances (default or weak credentials, unpatched firmware) and corporate employees authenticating to sensitive services like Microsoft 365 over untrusted networks without adequate protection. This matters because even MFA-protected accounts can be bypassed by AitM techniques that intercept session tokens in real time. The campaign's suspected link to APT28 (a Russian nation-state actor) underscores that corporate travelers are high-value targets, and the credentials harvested can enable espionage, data theft, or further lateral movement into enterprise environments.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — FrostArmada
- mitre_attack — T1187
- mitre_attack — T1557