Employees connecting to hotel or conference Wi-Fi are being targeted through the network equipment managing their connection, allowing attackers to redirect them to fake Microsoft login pages without sending a phishing email or infecting their computers.
The campaign has operated since at least June 2026, according to research published by ReliaQuest, which identified compromised Wi-Fi gateways in several US cities, India, and Saudi Arabia, with connections involving employees from finance, legal, health care, energy, retail, and professional services organizations.
For context, a hotel guest can join the venue’s genuine Wi-Fi network and still be exposed. Once attackers obtain administrative access to its gateway, they can alter the system that directs internet traffic for every connected guest.
Compromised Wi-Fi Redirects Microsoft Logins
When a device requests a website, DNS converts its name into the numerical address needed to reach it. A compromised gateway can provide a false answer, sending the browser to infrastructure operated by the attacker.
ReliaQuest observed Microsoft-themed domains such as m365-owa.com, owa-ms365.com, ms365-device.com and ms365-live.com. These were not Microsoft services, but names designed to resemble legitimate Microsoft 365 and Outlook addresses.
According to ReliaQuest’s blog post, travelers redirected to those pages could be asked to enter their login details. In a limited number of cases, the attackers also abused Microsoft’s device-code authentication process. A victim approving the request could give the attacker valid access tokens, even when multifactor authentication was completed on a genuine Microsoft page.
The researchers believe the gateways may have been compromised through internet-facing management services combined with weak or reused administrator passwords. However, limited access to the affected devices prevented them from confirming the initial entry method.
Some affected devices also attempted to use Windows Web Proxy Auto-Discovery, known as WPAD, to route application traffic through an attacker-controlled proxy. ReliaQuest saw this activity in roughly one-third of the examined cases but could not confirm that it succeeded.
Techniques Resemble Earlier APT28 Campaigns
ReliaQuest found similarities between this operation and earlier router attacks associated with APT28, also called Fancy Bear and Forest Blizzard. The Russian military intelligence group has previously been linked to DNS manipulation used to compromise Microsoft 365 accounts.
Those similarities include taking control of network gateways, altering DNS responses and directing Microsoft authentication traffic through an adversary-in-the-middle service. ReliaQuest did not directly attribute the new campaign to APT28 because it found no shared infrastructure, reused code or other firm technical connection.
Additionally, researchers found several differences. For instance, the current operation targets hotel and conference Wi-Fi equipment, while earlier APT28 reporting focused on home and small-office routers. Its domains and IP addresses also differ from infrastructure previously associated with the Russian group.
Always-On VPN Stops the Wi-Fi Redirect
ReliaQuest says an always-on, full-tunnel VPN can stop this attack by sending internet traffic and DNS requests through the company network. The hotel gateway cannot redirect the employee to a fake login page because the VPN handles those requests first.
This protection needs to activate as soon as the device connects. A VPN that employees start manually may leave a short period when the hotel network can interfere with traffic, while split tunneling can leave DNS requests outside the protected connection.
The researchers also warn that simply changing the device to Google’s 8.8.8.8 DNS service is not enough. Unless the request is encrypted, it still travels through the compromised gateway, which can intercept it and return a false address.
Nevertheless, employees should reject unexpected Microsoft login or authorization requests on public Wi-Fi and tell their employer which venue and network they were using.
