[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3LuzDsaeitOO224N72anaP8COnLyeTacSkvbk0nDKVU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"f072bb82-99e9-4009-bec5-f40e40b5a926","apt28-hijacks-hotel-wi-fi-dns-to-harvest-microsoft-365-credentials","0ea4f9db-342a-4bdb-a323-b341944bb3fe","APT28 Hijacks Hotel Wi-Fi DNS to Harvest Microsoft 365 Credentials","Attackers compromised Wi-Fi gateway DNS settings in hotels and conference centers to silently redirect users to convincing fake Microsoft 365 login pages, stealing corporate credentials at scale. The campaign is particularly dangerous because it exploits trusted public infrastructure that users have little reason to question. Critically, the attackers leveraged the device-code authentication flow to bypass MFA, invalidating a control many organizations rely on as a last line of defense. This highlights that MFA alone is insufficient when authentication protocols can be abused, and that DNS integrity on shared networks is a serious, often overlooked attack surface.","**Immediate actions:**\n- Enforce FIDO2\u002Fphishing-resistant hardware MFA (e.g., YubiKey) for all Microsoft 365 accounts to defeat device-code phishing.\n- Disable or restrict the OAuth device-code authentication flow in Azure AD Conditional Access policies unless explicitly required.\n- Brief traveling employees to use a corporate VPN immediately upon connecting to any public or hotel Wi-Fi network.\n\n**Long-term improvements:**\n- Deploy DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on all corporate endpoints to prevent DNS hijacking on untrusted networks.\n- Implement Conditional Access policies that restrict logins from untrusted or anonymous network locations to high-assurance authentication methods only.\n- Maintain a travel security policy that explicitly addresses credential hygiene and authentication risks when connecting from hotels or conference venues.\n\n**Detection measures:**\n- Enable Microsoft 365 sign-in risk policies and monitor for impossible travel, unfamiliar locations, and anomalous device-code grant events in Azure AD logs.\n- Alert on DNS resolution anomalies and unexpected certificate changes for critical SaaS login domains using network monitoring tools.\n- Integrate threat intelligence feeds covering APT28 TTPs into your SIEM to accelerate detection of matching indicators of compromise.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4.6 – Use of Secure Authentication","CIS Control 9.2 – Use DNS Filtering Services","CIS Control 12.6 – Use of Secure Network Protocols","NIST SP 800-207 – Zero Trust Architecture","NIST AC-17 – Remote Access","NIST IA-2(6) – Phishing-Resistant MFA","NIST SC-20 – Secure Name\u002FAddress Resolution Service","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1078 – Valid Accounts","MITRE ATT&CK T1071 – Application Layer Protocol","GDPR Article 32 – Security of Processing","ISO\u002FIEC 27001 A.9.4 – System and Application Access Control",{},"published","2026-07-24T18:20:23.796114+00:00","2026-07-24T18:20:23.686+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts\u002F","hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts-bc184f","Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"930bbc16-25e4-42e2-9b08-bcca9eb8f473","2026-07-25","morning","ThreatNoir Weekend Brief — July 25","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-25\u002Fthreatnoir-morning-brief-2026-07-25.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":64,"name":65,"problem":66},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":68,"name":69,"problem":70},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]