Hotel Wi-Fi Gateways Weaponized to Steal Microsoft 365 Credentials
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers compromised poorly secured hotel and conference Wi-Fi gateway devices to manipulate DNS and redirect business travelers to convincing fake Microsoft 365 login pages, harvesting credentials and session tokens. The exploitation of Microsoft's device-code authentication flow allowed attackers to bypass MFA entirely, demonstrating that MFA alone is not a silver bullet when authentication protocols themselves can be abused. This attack is particularly dangerous because victims have no visible warning signs — they believe they are on a legitimate network using a trusted service. Business travelers are high-value targets as they routinely access sensitive corporate resources on unfamiliar networks, making robust endpoint and authentication controls critical.
Tactical Insight
Immediate actions
- Enforce phishing-resistant MFA (FIDO2/hardware keys) for all Microsoft 365 accounts to prevent device-code authentication abuse.
- Instruct employees to use a corporate VPN before accessing any company resources on hotel or public Wi-Fi networks.
- Disable or restrict the OAuth device-code authentication flow in Azure AD/Entra ID conditional access policies unless explicitly required.
Long-term improvements
- Implement Zero Trust Network Access (ZTNA) so corporate resources are never directly exposed to untrusted network paths.
- Conduct regular security awareness training specifically covering risks of public Wi-Fi, fake login portals, and social engineering targeting travelers.
- Audit and harden all network gateway equipment (default credentials, firmware versions, admin access) used in corporate-managed facilities.
Detection measures
- Deploy anomalous sign-in detection and alert on impossible travel, unfamiliar device, or token reuse events in Microsoft Entra ID / Defender for Identity.
- Monitor DNS query logs for unexpected redirections or anomalous external DNS resolver usage on managed networks.
- Establish a threat intelligence feed for known APT TTPs (e.g., APT28 device-code phishing) and apply corresponding detection rules in your SIEM.