[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6mO_70w14-bi9HnkEmsMqFORKAjnJCSzCJaHKL4Qpjo":3},{"article":4,"iocs":53,"watch_terms":65,"solutions":66,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4f7cd7ee-c295-433e-b8db-066938d01150","Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts","hackers-compromise-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-567217","Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens.","A campaign active since at least June 2026 has compromised Wi-Fi gateways in multiple countries to redirect business travelers to fake Microsoft 365 login pages, stealing credentials and authorization tokens. Attackers gain administrative access to hotel and conference network equipment, manipulate DNS responses, and in some cases exploit Microsoft's device-code authentication to bypass MFA. The techniques resemble earlier APT28 operations, though ReliaQuest found no definitive attribution to the Russian group.","Hackers compromise hotel Wi-Fi gateways to redirect travelers to fake Microsoft 365 login pages and steal credentials.","https:\u002F\u002Fhackread.com\u002Fhackers-hotel-wi-fi-gateways-hijack-microsoft-365-accounts\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002Fhackers-hotel-wi-fi-gateway-hijack-microsoft-365-accounts.jpg","2026-07-27T14:43:57+00:00","2026-07-27T16:00:15.726504+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"APT28","threat_actor",{"name":21,"type":19},"Fancy Bear",{"name":23,"type":19},"Forest Blizzard",{"name":25,"type":26},"Microsoft","vendor",{"name":28,"type":29},"Microsoft 365","product",{"name":31,"type":26},"ReliaQuest","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":32,"icon":34,"name":35,"slug":36},null,"Identity & Access","identity-access",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60,63],{"type":55,"value":56,"context":57},"domain","m365-owa.com","Fake Microsoft 365\u002FOutlook domain used in redirects",{"type":55,"value":59,"context":57},"owa-ms365.com",{"type":55,"value":61,"context":62},"ms365-device.com","Fake Microsoft 365 domain used in redirects",{"type":55,"value":64,"context":62},"ms365-live.com",[25,31,28],{"controls":67,"vendors":151},[68,96,125],{"slug":69,"name":70,"problem":71,"products":72},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[73,80,88],{"vendor_slug":74,"vendor_name":25,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":126,"name":127,"problem":128,"products":129},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[130,138,143],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":139,"product_name":140,"url":141,"description":142},"umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",[152,155],{"slug":74,"name":25,"logo_path":75,"roles":153},[154],"affected",{"slug":156,"name":31,"logo_path":157,"roles":158},"reliaquest","\u002Fvendor-logos\u002Freliaquest.png",[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":180},"hotel-wi-fi-gateways-weaponized-to-steal-microsoft-365-credentials","Hotel Wi-Fi Gateways Weaponized to Steal Microsoft 365 Credentials","Attackers compromised poorly secured hotel and conference Wi-Fi gateway devices to manipulate DNS and redirect business travelers to convincing fake Microsoft 365 login pages, harvesting credentials and session tokens. The exploitation of Microsoft's device-code authentication flow allowed attackers to bypass MFA entirely, demonstrating that MFA alone is not a silver bullet when authentication protocols themselves can be abused. This attack is particularly dangerous because victims have no visible warning signs — they believe they are on a legitimate network using a trusted service. Business travelers are high-value targets as they routinely access sensitive corporate resources on unfamiliar networks, making robust endpoint and authentication controls critical.",[165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-17 – Remote Access","NIST AC-2 – Account Management","NIST SI-3 – Malicious Code Protection","NIST SC-20\u002FSC-21 – DNS Security","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1528 – Steal Application Access Token","MITRE ATT&CK T1566.003 – Phishing: Spearphishing via Service","GDPR Article 32 – Security of Processing (for EU traveler data at risk)","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control","ITIL Service Transition – Change and Configuration Management",{}]