Listen to this Post
A New Threat Is Waiting Behind the Login Screen
For years, cybersecurity awareness has focused on a familiar warning: do not click suspicious links, do not open unexpected attachments, and do not enter your password into a fake website.
But what happens when the employee does everything right?
What if there is no phishing email, no suspicious attachment, and no obvious warning that something is wrong?
A newly uncovered campaign targeting hotel Wi-Fi infrastructure shows how attackers can move the battlefield away from the victim’s laptop and into the network the victim already trusts. According to ReliaQuest, attackers have compromised Wi-Fi gateways in hotels, conference centers, and other shared venues, manipulating network traffic and redirecting users toward malicious infrastructure designed to compromise Microsoft 365 accounts.
The campaign has reportedly been active since at least June 2026 and has affected infrastructure across multiple locations in the United States, India, and Saudi Arabia. The victims observed connecting through affected networks came from organizations operating in financial services, healthcare, legal services, energy, retail, and other professional sectors.
This is what makes the campaign particularly concerning. Business travelers are often among the most valuable targets for cybercriminals and espionage groups. They carry corporate devices, access sensitive cloud services, and frequently connect to networks outside the protection of their normal office infrastructure.
The attack does not necessarily depend on convincing someone to make a mistake.
Instead, it attempts to manipulate the environment surrounding them.
The Campaign Targets the Network Instead of the Device
ReliaQuest identified attackers gaining administrative control over captive-portal gateways used by hotels and other shared Wi-Fi environments.
Captive portals are the pages users often encounter when connecting to public Wi-Fi. They may ask guests to accept terms of service, enter a room number, authenticate, or simply click a button before gaining internet access.
These systems sit at a critical point between the user and the wider internet.
Once attackers gain administrative control over such infrastructure, they may be able to manipulate how connected devices reach online services.
In this campaign, the attackers reportedly manipulated DNS responses.
DNS, or the Domain Name System, acts like a directory for the internet. When a user enters the name of a website or cloud service, DNS helps determine where that request should be sent.
If an attacker can interfere with that process, the victim may believe they are connecting to a legitimate destination while the network quietly directs them somewhere else.
That changes the traditional phishing equation completely.
The malicious link may not arrive in an email.
The user may not need to manually visit a suspicious domain.
The network itself can become the mechanism that pushes the victim toward attacker-controlled infrastructure.
Microsoft 365 Users Become the High-Value Target
The attackers reportedly used Microsoft-themed domains and infrastructure to facilitate credential theft and account compromise.
Microsoft 365 is an especially attractive target because a single successful compromise can provide access to email, documents, collaboration platforms, cloud applications, internal communications, and potentially sensitive corporate information.
For an attacker, compromising a Microsoft 365 identity can be far more valuable than compromising an individual endpoint.
A cloud identity can follow the victim across devices and networks.
It can provide persistent access to corporate resources.
It can also become the starting point for further attacks, including business email compromise, internal phishing, data theft, and privilege escalation.
The danger is not simply the theft of a password.
Modern identity attacks increasingly focus on something even more valuable: authenticated sessions and valid access tokens.
Device-Code Abuse Raises the Stakes
ReliaQuest also observed cases involving abuse of
Device-code authentication is designed to make it easier for users to authenticate on devices that may not have a convenient browser or keyboard. A user receives a code and completes authentication through another device or browser.
Under normal circumstances, this workflow can be useful and legitimate.
But attackers can abuse legitimate authentication mechanisms when they manipulate users or redirect traffic.
If a victim is tricked into completing authentication in an attacker-controlled flow, the attacker may potentially obtain valid OAuth tokens associated with the authenticated account.
This is particularly dangerous because a token-based attack may bypass some of the traditional defenses associated with stolen passwords.
The attacker is no longer simply presenting a guessed password.
They may be attempting to obtain a valid authentication artifact generated through a legitimate cloud identity system.
In some scenarios, this can result in access that already satisfies multi-factor authentication requirements.
That means MFA remains essential, but organizations must understand an uncomfortable reality: MFA is not a magical shield against every identity attack.
If an attacker can manipulate the authentication process itself, defenders need additional controls capable of detecting suspicious token use, unusual device registrations, abnormal network behavior, and impossible or unexpected access patterns.
WPAD Abuse Could Expand the Attack Surface
ReliaQuest also observed attempted abuse of WPAD in approximately one-third of the investigated cases.
WPAD, or Web Proxy Auto-Discovery, is a mechanism that can help systems automatically locate proxy configuration settings.
If attackers can successfully manipulate this process, they may potentially influence where certain application traffic is routed.
This could create additional opportunities for interception or manipulation.
The importance of this detail should not be underestimated.
The attack is not limited to a single fake login page.
The broader objective appears to involve gaining control over the network environment and using that position to influence how devices communicate with external services.
Once a hostile actor controls part of the network path, every service that depends on that path deserves additional scrutiny.
Corporate Travelers Are an Attractive Target
Hotels and conference centers create an unusually attractive environment for attackers.
They bring together executives, engineers, lawyers, consultants, financial professionals, healthcare workers, government personnel, and employees from countless organizations.
A single compromised gateway may expose traffic from many different companies.
The attacker does not need to breach each organization individually.
They can wait for valuable targets to connect.
This creates a form of opportunistic targeting.
A compromised hotel network can become a fishing net cast into a pool filled with corporate identities.
The attacker may not know exactly who will connect.
But when a senior executive, security engineer, financial employee, or legal professional joins the network, the potential value of the operation changes immediately.
This is one reason shared infrastructure deserves far more security attention than it often receives.
A weakness in one gateway can create consequences for dozens or even hundreds of unrelated organizations.
The Infrastructure Is Becoming the New Phishing Layer
Traditional phishing attacks usually attempt to bring the victim to malicious infrastructure.
The attacker sends an email.
The victim receives a message.
The victim clicks a link.
The victim eventually reaches the
This campaign demonstrates a different possibility.
Instead of delivering the malicious destination directly to the victim, attackers can attempt to manipulate the infrastructure that decides where the victim goes.
The interception point moves.
The endpoint may remain uncompromised.
The user may behave cautiously.
The email inbox may never receive a phishing message.
Yet the connection can still become part of an identity compromise attempt.
This represents an important evolution in attack strategy.
Cybersecurity teams must increasingly think beyond the device itself.
Security now depends on the entire chain of trust between the user and the cloud service.
That includes DNS.
It includes Wi-Fi gateways.
It includes captive portals.
It includes proxy settings.
It includes authentication workflows.
And it includes the OAuth tokens that ultimately authorize access.
Tradecraft Overlaps With APT28, but Attribution Remains Unconfirmed
ReliaQuest said the techniques used in the campaign overlap with tradecraft previously associated with APT28, also known as Fancy Bear and Forest Blizzard, a threat group widely linked by governments and security researchers to Russian military intelligence.
However, ReliaQuest did not directly attribute this campaign to APT28.
This distinction is important.
Technique overlap is not the same as confirmed attribution.
Threat actors can copy tools, imitate operational methods, reuse publicly known techniques, or deliberately create false signals designed to point investigators toward another group.
Without direct technical evidence such as shared infrastructure, malware code, operational identifiers, or other reliable links, attribution should remain cautious.
The techniques may resemble activity previously associated with APT28.
That does not automatically prove that APT28 is responsible for this specific campaign.
In threat intelligence, evidence matters more than familiarity.
Always-On VPN Protection Becomes More Important
ReliaQuest’s primary recommendation for corporate travelers is straightforward: enforce an always-on, full-tunnel VPN.
A properly configured full-tunnel VPN can send DNS requests and other network traffic through trusted corporate infrastructure rather than relying directly on DNS services provided by the hotel or public Wi-Fi network.
This can reduce the
However, a VPN should not be viewed as the only defensive layer.
Organizations should also consider enforcing secure DNS practices, monitoring unusual OAuth activity, restricting risky authentication flows, reviewing device-code authentication where appropriate, and applying conditional access policies that evaluate device posture and location.
Public Wi-Fi should be treated as hostile infrastructure by default.
Even when the hotel is legitimate.
Even when the network name appears correct.
Even when the login page looks professional.
Trusting the location does not guarantee the security of the network.
The Attack Surface Extends Beyond Hotels
Although hotels are a major focus of this campaign, the underlying problem extends much further.
Conference centers, airports, coworking spaces, cafes, universities, and other shared environments can all create opportunities for similar infrastructure-focused attacks.
Anywhere users depend on third-party network equipment, attackers may see an opportunity to compromise the infrastructure rather than attack every individual device.
This creates an important strategic challenge for defenders.
Organizations often spend heavily securing their endpoints.
They deploy endpoint detection systems.
They patch operating systems.
They monitor malware.
They train employees to identify phishing.
But the network sitting underneath the connection may belong to someone else.
That creates a blind spot.
A perfectly patched laptop can still be exposed to a hostile environment if the surrounding network is manipulating traffic.
What Undercode Say:
The Real Innovation Is Not Credential Theft
The most important part of this campaign is not that attackers want Microsoft 365 credentials.
Attackers have targeted Microsoft accounts for years.
The significant development is the location of the attack.
The hostile activity has moved closer to the network layer.
The victim can become exposed before opening an email.
The attacker can exploit infrastructure that users already consider legitimate.
This reduces the effectiveness of awareness training alone.
You cannot train an employee to avoid every threat if the trusted network itself becomes the delivery mechanism.
Identity Security Must Move Beyond Password Protection
Organizations have spent years telling employees to protect their passwords.
Then they added MFA.
Now the threat landscape is increasingly focused on tokens, sessions, OAuth permissions, authentication flows, and trusted infrastructure.
A password can be changed.
A stolen authentication token may provide immediate access.
An organization therefore needs to monitor the entire identity lifecycle.
Who authenticated?
From which device?
Using which application?
Through which authentication flow?
What token was issued?
What resources did that token access?
These questions are becoming as important as the password itself.
DNS Is a Critical Security Boundary
DNS is often treated as background infrastructure.
Users rarely think about it.
Attackers do.
Manipulating DNS can redirect trust.
A legitimate service name can become a pathway toward malicious infrastructure if the resolution process is compromised.
Organizations should therefore monitor DNS anomalies.
Unexpected resolver changes should generate alerts.
Corporate devices should avoid relying blindly on unknown network-provided DNS servers.
Encrypted DNS and full-tunnel VPN policies can reduce exposure, depending on the organization’s architecture.
Captive Portals Deserve More Security Scrutiny
Captive portals are commonly treated as simple convenience systems.
But they sit directly between users and internet access.
If administrative access to these systems is weak, the consequences can extend beyond the hotel itself.
A compromised captive portal can become an operational platform for targeting visitors.
Hospitality organizations should treat these gateways as security-critical infrastructure.
Administrative interfaces should not be casually exposed.
Default credentials must be eliminated.
Remote management should be restricted.
Firmware should be maintained.
Logs should be centralized and monitored.
Device-Code Authentication Needs Policy Review
Legitimate authentication features can become dangerous when attackers learn how to abuse them.
Security teams should review whether device-code authentication is necessary for every user and every application.
Where possible, organizations should apply conditional access restrictions.
Unexpected device-code authentication events should be investigated.
Users should also be educated not to approve authentication requests or enter codes they did not initiate themselves.
The goal is not to eliminate useful technology.
The goal is to understand where legitimate workflows can be weaponized.
VPN Enforcement Should Be Architectural, Not Optional
Telling employees to manually enable a VPN is no longer enough.
Users forget.
Some disconnect the VPN to solve connectivity problems.
Others may not understand whether the VPN is using full tunneling or split tunneling.
Security should not depend entirely on perfect user behavior.
Always-on VPN policies can automate protection.
Full-tunnel configurations can ensure that traffic does not silently fall back to infrastructure controlled by an untrusted network.
The stronger model is simple: if the corporate device connects to the internet, it should do so through a controlled security architecture.
Endpoint Security Cannot See Everything
An endpoint detection platform may show a perfectly healthy laptop.
No malware.
No malicious process.
No suspicious executable.
Yet the user may still be interacting with attacker-controlled infrastructure.
This creates a visibility gap.
Defenders need correlation between endpoint telemetry, DNS activity, identity logs, proxy logs, and cloud authentication events.
Security teams that investigate each system in isolation may miss the full attack chain.
Hotels Are Becoming Shared Corporate Attack Surfaces
A hotel network is no longer just an IT asset supporting guests.
For attackers, it can become a gateway into multiple corporations.
This makes hospitality infrastructure strategically important.
A single successful compromise may create access to a constantly changing population of high-value users.
Executives arrive.
Consultants arrive.
Engineers arrive.
Legal teams arrive.
Financial professionals arrive.
The network becomes a collection point for potential targets.
Attribution Requires Discipline
The overlap with techniques associated with APT28 is important.
But it should not become a shortcut to attribution.
Cybersecurity reporting becomes weaker when analysts transform similarity into certainty.
Threat actors share techniques.
Tools leak.
Public research reveals operational methods.
False flags are possible.
The strongest intelligence reports separate what is known from what is suspected.
That distinction protects the credibility of the investigation.
Zero Trust Must Include the Network
The phrase “Zero Trust” is often discussed in relation to users and devices.
But this campaign demonstrates why networks must also be treated as untrusted.
A legitimate hotel.
A legitimate conference center.
A legitimate Wi-Fi name.
None of these automatically create a trustworthy security boundary.
The device should authenticate services independently.
The organization should encrypt traffic.
Identity systems should evaluate context.
Network location alone should not determine trust.
The Defensive Priority Is Visibility
Companies should search for abnormal DNS activity.
They should investigate unusual OAuth token issuance.
They should identify unexpected device-code authentication events.
They should monitor new proxy configurations.
They should review sign-ins originating during employee travel.
They should correlate these events with hotel and public Wi-Fi usage where privacy and policy allow.
The most dangerous attacks are often the ones that look legitimate at first.
The Future of Phishing May Be Infrastructure-Driven
The next generation of phishing may not always arrive in an inbox.
Attackers are increasingly looking for ways to compromise trusted systems that users already depend on.
The delivery mechanism can change.
The objective remains the same.
Gain trust.
Capture authentication.
Obtain access.
Move deeper.
Organizations that only defend against malicious messages may find themselves defending against yesterday’s attack model.
Deep Analysis
Monitoring DNS Configuration Changes
Security teams can inspect DNS resolver configuration on Linux systems with:
resolvectl status
On systems using traditional resolver configuration, administrators can also review:
cat /etc/resolv.conf
Unexpected DNS servers, especially after connecting to public Wi-Fi, should be investigated.
Inspecting Network Routes
A compromised network environment may attempt to influence traffic routing.
Administrators can inspect active routes with:
ip route
To review the active network interfaces:
ip addr
Unexpected gateways or unusual interface configurations can provide useful investigation leads.
Reviewing Proxy Environment Settings
Attackers attempting proxy manipulation may leave configuration artifacts.
Linux users can inspect common proxy environment variables with:
env | grep -i proxy
Administrators can also search system configuration directories:
grep -Rni "proxy" /etc 2>/dev/null
Any unexpected proxy configuration should be verified against approved corporate infrastructure.
Capturing DNS Traffic During Investigation
Security teams investigating suspicious network behavior can capture DNS traffic using:
sudo tcpdump -ni any port 53
For encrypted DNS environments, investigators may need endpoint, proxy, firewall, or DNS resolver logs to understand where requests are being sent.
Checking Active Connections
To review active network connections and associated processes:
ss -tulpn
For broader connection visibility:
ss -tunap
Unexpected outbound connections should be correlated with DNS activity and authentication events.
Reviewing Network Manager Logs
On Linux systems using NetworkManager, recent network events can be inspected with:
journalctl -u NetworkManager --since "24 hours ago"
This may help investigators determine when a device joined a particular Wi-Fi network or when network configuration changed.
Searching for Suspicious Resolver Changes
Administrators can search system logs for resolver-related events:
journalctl --since "24 hours ago" | grep -Ei "dns|resolver|wpad|proxy"
This can help identify unusual network behavior during or after travel.
Hardening Corporate Travelers
A simple operational check can verify whether a VPN interface is active:
ip addr | grep -Ei "tun|tap|wg"
Organizations should also verify that DNS traffic is actually being routed through the protected tunnel rather than leaking to the local network.
The key question is not simply, “Is the VPN connected?”
The more important question is, “Is the sensitive traffic actually protected?”
Confirmed Campaign Activity
✅ ReliaQuest reported a campaign active since at least June 2026 involving compromised Wi-Fi gateway infrastructure and DNS manipulation targeting users of shared networks.
APT28 Attribution Remains Unconfirmed
❌ It is not accurate to state that ReliaQuest definitively attributed this campaign to APT28. The researchers identified tradecraft overlap but reported no direct technical evidence sufficient for confirmed attribution.
Microsoft 365 Authentication Is a Key Target
✅ The reported activity included Microsoft-themed infrastructure, credential and account compromise attempts, device-code authentication abuse, and activity that could potentially lead to access through valid OAuth tokens.
Prediction
The Hospitality Sector Will Face More Identity-Focused Attacks
(-1) Public and semi-public Wi-Fi infrastructure is likely to become an increasingly attractive target because compromising a single network can expose attackers to users from many unrelated organizations.
Attackers will likely invest more heavily in infrastructure-level attacks that avoid traditional email-based phishing detection.
Security teams may increasingly monitor DNS, OAuth tokens, device-code authentication, and proxy configuration alongside traditional endpoint telemetry.
Hotels, conference centers, airports, and other shared connectivity providers may face greater pressure to treat guest network equipment as security-critical infrastructure rather than simple connectivity systems.
Organizations that enforce always-on full-tunnel VPN protection and stronger identity monitoring will be better positioned to reduce exposure when employees travel.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
