Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

Attackers compromised poorly secured hotel and conference Wi-Fi gateway devices to manipulate DNS and redirect business travelers to convincing fake Microsoft 365 login pages, harvesting credentials and session tokens. The exploitation of Microsoft's device-code authentication flow allowed attackers to bypass MFA entirely, demonstrating that MFA alone is not a silver bullet when authentication protocols themselves can be abused. This attack is particularly dangerous because victims have no visible warning signs — they believe they are on a legitimate network using a trusted service. Business travelers are high-value targets as they routinely access sensitive corporate resources on unfamiliar networks, making robust endpoint and authentication controls critical.