Listen to this Post
Introduction: The Hidden Danger Lurking Behind Free Wi-Fi
For years, cybersecurity experts have warned travelers about the risks of connecting to public Wi-Fi. Most people assumed the greatest threat was a fake hotspot or an unsecured network. However, a newly uncovered cyber campaign demonstrates something even more alarming: attackers no longer need to trick users with phishing emails or compromise their devices with malware. Instead, they compromise the Wi-Fi infrastructure itself.
This sophisticated attack targets hotels, conference centers, airports, and coworking spaces by taking control of guest Wi-Fi gateways. Once attackers gain administrative access, every connected device becomes a potential victim. Employees traveling for business unknowingly authenticate into fake Microsoft 365 login pages while believing they are communicating with Microsoft’s legitimate services.
Active since at least June 2026, this campaign has already impacted multiple countries and organizations across various industries, proving that business travelers themselves—not specific companies—are the true targets.
Campaign Summary: Infrastructure Instead of Endpoints
Unlike conventional phishing operations that rely on convincing victims to click malicious links, this campaign attacks the network infrastructure responsible for providing internet access.
Threat actors compromise captive portal appliances that manage guest authentication in hotels, airports, conference centers, and similar public venues. Once administrative access is obtained, attackers manipulate DNS configurations distributed through DHCP, silently redirecting users toward attacker-controlled Microsoft 365 login portals.
Because the attack occurs at the network layer, victims never receive suspicious emails, malicious attachments, or infected software. Everything appears completely legitimate from the user’s perspective.
This significantly increases the success rate while dramatically reducing the chances of detection.
How the Attack Begins
The attackers first gain administrative control over Wi-Fi gateway appliances.
Investigators believe this access is likely achieved through exposed management interfaces, default credentials, weak passwords, or reused administrator credentials leaked from previous breaches.
After compromising the gateway, attackers modify the DNS settings distributed to every device joining the wireless network.
Every smartphone, laptop, and tablet automatically trusts these DNS settings unless manually configured otherwise.
From this point onward, the attackers effectively control where internet requests are directed.
DNS Poisoning Becomes the Primary Weapon
DNS functions as the
Instead of allowing
When users attempt to visit Microsoft login services, they are quietly redirected to attacker-controlled infrastructure hosting nearly identical Microsoft 365 login pages.
The browser address may appear convincing enough that most travelers never suspect anything unusual.
Victims willingly enter their usernames, passwords, and in some cases complete multi-factor authentication, believing they are accessing legitimate Microsoft services.
Microsoft Device Code Abuse Expands the Threat
Researchers also observed attackers abusing
Normally, this authentication method allows devices with limited input capabilities—such as smart TVs or IoT devices—to authenticate securely.
Cybercriminals exploit this legitimate Microsoft feature by convincing victims to authorize attacker-controlled sessions.
Instead of stealing passwords directly, attackers obtain valid authentication tokens capable of bypassing certain security controls.
Because the authentication process itself is legitimate, many traditional security solutions struggle to recognize the malicious activity.
The Campaign Targets Travelers, Not Companies
One of the most interesting findings is that this operation is industry-agnostic.
Affected organizations include:
Financial institutions
Healthcare providers
Law firms
Energy companies
Retail businesses
Professional services firms
The common denominator is simple:
Employees frequently travel.
Every hotel stay, conference attendance, airport lounge visit, or coworking session presents another opportunity for attackers to intercept credentials.
Rather than targeting specific organizations, attackers wait for valuable users to connect.
Global Reach Continues to Expand
Researchers identified compromised Wi-Fi environments across multiple regions.
Confirmed activity has been observed in:
United States
India
Saudi Arabia
Given the nature of gateway compromises, researchers believe additional affected locations likely remain undiscovered.
Each compromised hotel can potentially expose hundreds or thousands of guests before administrators realize anything is wrong.
Malicious Infrastructure Identified
Threat intelligence researchers linked several domains to the operation, including:
m365-owa[.]com
owa-ms365[.]com
ms365-device[.]com
ms365-live[.]com
Associated infrastructure included multiple IP addresses responsible for DNS poisoning and hosting spoofed Microsoft authentication portals.
The domains closely resemble
WPAD Abuse Adds Another Layer
Beyond DNS manipulation, attackers also attempted to exploit the Web Proxy Auto-Discovery Protocol (WPAD).
WPAD automatically discovers proxy configurations after devices connect to a network.
A compromised gateway can provide a malicious proxy configuration file, causing Windows and macOS systems to send portions of their network traffic through attacker-controlled servers.
This allows attackers to inspect, modify, or redirect application communications while remaining nearly invisible.
Although WPAD attacks are not new, combining them with DNS poisoning significantly increases operational flexibility.
Connection to Previous Nation-State Tradecraft
Researchers noticed similarities between this campaign and historical router-focused operations associated with APT28 (Fancy Bear / Forest Blizzard).
Shared techniques include:
Network appliance compromise
DNS manipulation
Adversary-in-the-middle operations
Microsoft credential theft
Token interception
However, investigators emphasize that no definitive technical evidence currently attributes this campaign directly to APT28.
The similarities are noteworthy but remain circumstantial.
Why This Attack Is More Dangerous Than Traditional Phishing
Traditional phishing campaigns depend on human error.
Users must click malicious emails, open attachments, or ignore browser warnings.
This operation removes almost every one of those barriers.
Victims voluntarily access Microsoft services through what they believe is a trusted hotel network.
No malware needs to execute.
No endpoint exploit occurs.
No suspicious email arrives.
Instead, the network itself becomes the attacker.
This represents a major evolution in credential theft operations.
How Organizations Can Defend Against Gateway-Based Attacks
Organizations should educate employees that public Wi-Fi is never inherently trustworthy, regardless of the hotel’s reputation.
Recommended defenses include:
Always use corporate VPN connections before authenticating to Microsoft 365.
Verify Microsoft login URLs before entering credentials.
Disable automatic connection to unknown Wi-Fi networks.
Enforce phishing-resistant multi-factor authentication such as FIDO2 security keys.
Monitor impossible travel alerts and unusual authentication events.
Review DNS and proxy configuration changes after joining unfamiliar networks.
Segment privileged administrative accounts from daily productivity accounts.
Implement Conditional Access policies that evaluate device health and network risk.
These measures dramatically reduce the effectiveness of network-based credential theft.
Deep Analysis
This campaign illustrates a strategic shift from attacking endpoints to attacking trust itself. By compromising the gateway rather than individual devices, adversaries gain leverage over every connected client with a single intrusion. Organizations should treat public network infrastructure as an untrusted environment and monitor authentication anomalies alongside endpoint telemetry.
Useful Investigation Commands
Windows – View DNS Cache
ipconfig /displaydns
Windows – Flush DNS Cache
ipconfig /flushdns
Windows – Display Current Proxy Settings
netsh winhttp show proxy
Windows – View Network Configuration
ipconfig /all
Linux – Check DNS Resolver
cat /etc/resolv.conf
Linux – Display Active Network Connections
ss -tunap
Linux – Test DNS Resolution
dig login.microsoftonline.com
Linux/macOS – Trace DNS Resolution
nslookup login.microsoftonline.com
PowerShell – Review Recent Sign-in Logs (Microsoft Graph Module)
Get-MgAuditLogSignIn
Network Monitoring
tcpdump -i any port 53
Administrators should also deploy DNS monitoring, secure DNS technologies (DNS-over-HTTPS or DNS-over-TLS where appropriate), and continuously validate captive portal infrastructure for unauthorized configuration changes. Combining network telemetry with Microsoft Entra ID sign-in analytics, Conditional Access policies, and Security Information and Event Management (SIEM) correlation can expose adversary-in-the-middle activity before widespread credential compromise occurs.
What Undercode Say:
This campaign marks one of the clearest examples of attackers shifting from endpoint exploitation to infrastructure manipulation. Instead of convincing users to make mistakes, the attackers exploit the implicit trust users place in public Wi-Fi.
The absence of phishing emails is particularly significant because many organizations still focus their awareness programs almost entirely on email-based attacks.
By controlling DNS, attackers can weaponize every application that depends on domain resolution—not just web browsers.
Business travelers remain one of the weakest security links because they frequently connect to unfamiliar networks outside corporate control.
Hotels often outsource network management, creating inconsistent security standards across locations.
Many gateway appliances still expose administrative interfaces with weak authentication.
Default credentials continue to be a recurring problem in network infrastructure.
Even organizations with strong endpoint protection cannot detect every network-layer attack.
VPN usage becomes far more valuable when connecting through public infrastructure.
Conditional Access policies can limit the usefulness of stolen credentials by enforcing device compliance and location-based risk assessments.
Phishing-resistant authentication methods such as FIDO2 security keys significantly reduce credential theft risks.
Device Code Flow abuse demonstrates how legitimate authentication mechanisms can be repurposed by attackers.
Attackers increasingly favor techniques that generate minimal endpoint indicators.
The campaign shows careful operational planning rather than opportunistic hacking.
DNS manipulation remains one of the most underestimated attack vectors in enterprise security.
Network administrators should regularly audit DNS behavior inside managed environments.
Security Operations Centers should correlate unusual DNS responses with authentication events.
Proxy configuration monitoring deserves renewed attention due to WPAD abuse.
Organizations should separate privileged accounts from routine user accounts.
Guest Wi-Fi infrastructure should undergo continuous security assessments.
Hotels handling enterprise customers may need stronger security compliance standards.
Supply chain security now extends beyond software to physical networking environments.
Identity has become the primary attack surface.
Cloud authentication systems are increasingly targeted instead of local infrastructure.
Threat actors understand that credentials often provide greater value than malware deployment.
Microsoft 365 remains among the highest-value cloud platforms for attackers.
Stolen authentication tokens can enable long-term persistence.
Browser-based attacks continue evolving beyond traditional phishing.
Infrastructure attacks scale efficiently against thousands of users simultaneously.
Threat intelligence sharing between hospitality providers and enterprises should improve.
Travel security policies should become part of corporate cybersecurity strategies.
Employees should verify login pages even when connected to seemingly legitimate networks.
Organizations must assume public Wi-Fi is hostile by default.
Security awareness training should now include DNS and captive portal risks.
Zero Trust networking principles are increasingly justified by campaigns like this.
Gateway hardening should become a priority for hospitality providers.
Managed Detection and Response teams should incorporate network-layer telemetry into investigations.
Credential monitoring alone is no longer sufficient.
Identity protection must work alongside network visibility.
This campaign is unlikely to remain isolated, and similar techniques will probably appear against additional cloud services beyond Microsoft 365.
The future of cyber defense depends on securing not only devices and identities but also every network path users trust without question.
✅ Fact: Public Wi-Fi gateways can be compromised and used to manipulate DNS responses, allowing attackers to redirect users to fraudulent websites without compromising their devices directly. This technique is well documented in network security research.
✅ Fact: DNS poisoning and WPAD abuse are legitimate attack techniques that can facilitate adversary-in-the-middle attacks, credential theft, and traffic interception when network infrastructure is under attacker control.
✅ Fact: While the campaign shares operational characteristics with tradecraft previously associated with APT28/Fancy Bear, there is currently no publicly available conclusive technical evidence directly attributing this operation to that threat group. Attribution should therefore be treated cautiously.
Prediction
(+1) Security vendors and hospitality providers will accelerate investment in gateway monitoring, secure DNS validation, and Zero Trust networking, making public Wi-Fi infrastructure significantly harder to compromise over the next few years.
(-1) Threat actors are likely to expand this technique beyond hotels and conference centers to airports, universities, hospitals, shopping malls, and other high-density public networks, while increasingly targeting authentication platforms other than Microsoft 365, making infrastructure-level attacks a growing global cybersecurity challenge.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
