[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEyLUm_vAOZPobjHzPsl_xC2QsiWJ4Wgfhu8_piVJp1g":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"7def0654-c940-4731-9518-1eb420d82b8c","Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials","hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials-8129ea","A threat actor has been using the compromised appliances to target the Microsoft 365 accounts of traveling corporate employees. The post Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials appeared first on SecurityWeek.","A threat actor has been compromising public Wi-Fi gateway appliances at hotels, conference centers, and other shared venues across the US, India, and Saudi Arabia to target Microsoft 365 accounts of traveling corporate employees. The attackers modified DNS configurations to redirect users to attacker-controlled infrastructure for credential harvesting using adversary-in-the-middle (AitM) techniques. The campaign, ongoing since at least June 2026, shares similarities with the FrostArmada campaign attributed to APT28 (Forest Blizzard\u002FFancy Bear), though infrastructure and targeting methods differ, suggesting either a copycat actor or a related group using similar tradecraft.","Threat actor hacks public Wi-Fi gateways to steal Microsoft 365 credentials from traveling corporate employees.","https:\u002F\u002Fwww.securityweek.com\u002Fhacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F02\u002FWi-Fi.jpeg","2026-07-27T10:50:19+00:00","2026-07-27T12:00:14.291386+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"APT28","threat_actor",{"name":21,"type":19},"Forest Blizzard",{"name":23,"type":19},"Fancy Bear",{"name":25,"type":26},"FrostArmada","campaign",{"name":28,"type":29},"Microsoft 365","product",{"name":31,"type":32},"ReliaQuest","vendor","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":33,"icon":35,"name":36,"slug":37},null,"Identity & Access","identity-access",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,62],{"type":56,"value":25,"context":57},"malware","Previously documented campaign attributed to APT28; current activity shares similar TTPs but differs in targeting and infrastructure",{"type":59,"value":60,"context":61},"mitre_attack","T1187","Forced authentication via adversary-in-the-middle (AitM) technique used to harvest credentials",{"type":59,"value":63,"context":64},"T1557","Adversary-in-the-middle attack to intercept victim traffic and harvest credentials",[31,28],{"controls":67,"vendors":153},[68,97,124],{"slug":69,"name":70,"problem":71,"products":72},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":98,"name":99,"problem":100,"products":101},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[102,110,116],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":111,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":111,"url":114,"description":115},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"slug":125,"name":126,"problem":127,"products":128},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[154],{"slug":155,"name":31,"logo_path":156,"roles":157},"reliaquest","\u002Fvendor-logos\u002Freliaquest.png",[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":178},"public-wi-fi-gateway-compromise-used-to-steal-m365-credentials-via-dns-hijacking","Public Wi-Fi Gateway Compromise Used to Steal M365 Credentials via DNS Hijacking","Attackers compromised public Wi-Fi gateway appliances at hotels and conference centers, modifying DNS configurations to silently redirect corporate travelers to attacker-controlled phishing infrastructure — a classic Adversary-in-the-Middle (AitM) attack. The root cause is a combination of poorly secured network appliances (default or weak credentials, unpatched firmware) and corporate employees authenticating to sensitive services like Microsoft 365 over untrusted networks without adequate protection. This matters because even MFA-protected accounts can be bypassed by AitM techniques that intercept session tokens in real time. The campaign's suspected link to APT28 (a Russian nation-state actor) underscores that corporate travelers are high-value targets, and the credentials harvested can enable espionage, data theft, or further lateral movement into enterprise environments.",[164,165,166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-63B: Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-17: Remote Access","NIST SC-20: Secure Name\u002FAddress Resolution Service","NIST SI-3: Malicious Code Protection","NIST SP 800-46: Guide to Enterprise Telework and Remote Access Security","MITRE ATT&CK T1557: Adversary-in-the-Middle","MITRE ATT&CK T1040: Network Sniffing","MITRE ATT&CK T1071.004: DNS Application Layer Protocol","ISO\u002FIEC 27001:2022 A.8.20: Networks Security","GDPR Article 32: Security of Processing (for EU traveler data at risk)",{}]