For years, security teams have trained employees to be suspicious of one thing above all: the email inbox. Don’t click unknown links, don’t open unexpected attachments, watch for spoofed sender addresses. But a campaign uncovered by threat-intelligence firm ReliaQuest shows that attackers have found a way around all of that training entirely. There’s no email. There’s no attachment. There’s no suspicious link to hover over. There’s just a hotel room, a laptop, and the Wi-Fi network the front desk handed you at check-in.
Since at least June 2026, hackers have been quietly taking over the network gateways that manage guest Wi-Fi at hotels and conference centers, and using that access to redirect business travelers straight into fake Microsoft 365 login pages. The technique bypasses email filters, endpoint protection, and — in some cases — multi-factor authentication, because the compromise happens at the network level, before a single suspicious file or link ever reaches the victim’s device.
This article breaks down how the campaign works, who appears to be behind it, how it connects to a much larger Russian state-sponsored operation dismantled earlier this year, and what travelers and IT teams can actually do about it.
What ReliaQuest Found
Cybersecurity company ReliaQuest identified a wave of compromised Wi-Fi gateways — the appliances hotels and conference venues use to run their guest internet and captive portal login pages — across multiple U.S. cities, as well as locations in India and Saudi Arabia. Traffic passing through these hijacked gateways was traced back to organizations spanning financial services, professional services, legal, healthcare, energy, and retail sectors, which told researchers this wasn’t a campaign targeting one industry — it was targeting anyone who travels for work and connects to the network wherever they land.
That distinction matters. Most phishing campaigns are built around a theme: a fake invoice for finance teams, a fake HR notice, a fake shipping alert. This one doesn’t need a theme, because it doesn’t care who you are. It only cares that you’re a business traveler opening a laptop and trying to check email before a meeting.
Once attackers gain administrative control of a hotel’s Wi-Fi gateway, they don’t need to plant malware on individual laptops or send a single phishing email. Instead, they alter the device’s DNS settings — the system that translates a web address like “login.microsoftonline.com” into the numeric IP address a browser actually connects to. With DNS poisoned at the gateway, every guest who connects to that Wi-Fi network and tries to reach a Microsoft domain gets silently redirected to attacker-controlled infrastructure instead, without any change to the address bar that would tip off a careful user.
Researchers identified several domains registered to host the fake login portals, including m365-owa[.]com, owa-ms365[.]com, and ms365-live[.]com — names close enough to Microsoft’s real branding to pass a quick glance, especially from someone jet-lagged and trying to get through their inbox before a 9 a.m. meeting.
How Attackers Got In: Weak Admin Interfaces, Not Zero-Days
One of the more sobering details in ReliaQuest’s reporting is how unglamorous the initial break-in likely was. The firm assessed with low-to-medium confidence that attackers gained access to the Wi-Fi appliances by exploiting exposed management interfaces — things like internet-facing SSH, SNMP, and web-based admin consoles — combined with weak or reused administrative credentials, rather than through some novel zero-day exploit.
In other words: no exotic hacking tools were required. Just an admin panel left open to the internet, protected by a password that was either weak, default, or reused from somewhere else. This is a familiar failure mode in network security — the equipment that keeps venues online is often installed once, configured minimally, and then left alone for years, all while quietly facing the open internet.
Because the compromise happens at the gateway rather than on the guest’s device, traditional defenses largely miss it. Email security tools have nothing to scan, because no email is sent. Endpoint detection software has nothing to flag, because no file touches the laptop. The redirection happens upstream, at the network level, in a piece of infrastructure the victim doesn’t own, can’t inspect, and has no reason to distrust.
The MFA Bypass: Device Code Phishing
Perhaps the most concerning wrinkle in this campaign is that it doesn’t just steal usernames and passwords — some victims were funneled through a technique capable of defeating multi-factor authentication entirely.
In these cases, a user connecting through the compromised Wi-Fi was shown a fake Microsoft page displaying what looked like a normal authorization prompt, similar to the ones legitimate apps use to request account access. Behind the scenes, though, the attacker had already initiated their own authentication session using Microsoft’s device code flow — a legitimate feature originally designed to let users sign into apps on devices without a convenient keyboard, like a smart TV or a printer, by entering a short code shown on screen.
When the victim approved what appeared to be a routine sign-in prompt, Microsoft issued a valid OAuth access token — but it went to the attacker’s client, not the user’s. No password was stolen. No one-time code was intercepted. The victim did the “approving” themselves, which is exactly why this method sails past multi-factor authentication: MFA is designed to confirm that the person signing in is who they say they are, not to confirm which application ends up holding the resulting token.
This same abuse of the device code flow has shown up before in unrelated phishing campaigns, but pairing it with gateway-level DNS hijacking is what makes this specific operation notable — it removes the last thing a cautious user might have relied on to catch the attack: the suspicious email that normally kicks the whole thing off.
Researchers also documented a secondary technique in about a third of observed cases: abuse of WPAD, the Web Proxy Auto-Discovery protocol Windows systems use to automatically find a proxy server. By manipulating WPAD responses from the compromised gateway, attackers could route a victim’s Windows application traffic through their own servers — giving them a second lever for intercepting traffic beyond DNS poisoning alone.
Who’s Behind It — And Why Attribution Is Murky
Naturally, the question everyone wants answered is: who’s doing this? ReliaQuest drew a careful comparison between this campaign and tactics previously linked to APT28 — the Russian military intelligence hacking group also known as Fancy Bear, Forest Blizzard, or GRU Unit 26165 — pointing to shared tradecraft including gateway-level DNS poisoning, adversary-in-the-middle positioning against Microsoft 365 authentication, and the overall playbook of turning network infrastructure into a silent credential-harvesting tool.
But ReliaQuest stopped short of formally attributing the hotel Wi-Fi campaign to APT28. The firm found no shared infrastructure, no reused code, and no other firm technical link connecting the two operations. There are also meaningful differences: the current campaign specifically targets hotel and conference Wi-Fi equipment, while the APT28 activity researchers are comparing it to focused on home and small-office routers. The domains and IP addresses in play are different too. Researchers also uncovered two techniques — the WPAD abuse and the device code phishing flow — that weren’t documented in the earlier APT28-linked activity at all.
Adding another layer of intrigue, later reporting from The Record indicated that Microsoft’s own internal assessment of the hotel Wi-Fi campaign leans more directly toward attributing it to APT28 than ReliaQuest’s initial, more cautious take. That’s not unusual in the threat intelligence world — different firms often see different slices of the same activity through their own telemetry, and reach different confidence levels as a result. What both assessments agree on is the style of the attack: quiet, infrastructure-level compromise aimed squarely at harvesting Microsoft 365 credentials from people who least expect it, precisely because there’s no phishing email to be suspicious of.
The FrostArmada Connection: A Much Bigger Story in the Background
To understand why researchers reached for the APT28 comparison so quickly, it helps to know what happened just months before this hotel Wi-Fi campaign came to light.
On April 7, 2026, the FBI, the U.S. Department of Justice, the National Security Agency, and partners from 15 countries announced the disruption of a much larger operation, code-named internally by Lumen Technologies’ Black Lotus Labs as “FrostArmada” and publicly by law enforcement as “Operation Masquerade.” That campaign, also attributed to APT28/GRU Unit 26165, had compromised roughly 18,000 small office and home office routers — mostly older MikroTik and TP-Link models — across 120 countries.
The mechanics were strikingly similar to what would later show up in the hotel campaign: attackers altered the DNS settings on compromised routers to redirect authentication traffic toward attacker-controlled virtual private servers, which acted as adversary-in-the-middle proxies capable of intercepting Microsoft logins and stealing OAuth tokens — all without ever placing malware on a victim’s actual computer.
At its peak in December 2025, FrostArmada was feeding data from more than 18,000 devices to GRU-controlled infrastructure, with confirmed victims including over 200 named organizations and roughly 5,000 consumer devices, concentrated among government ministries, law enforcement agencies, and IT and hosting providers across North Africa, Central America, Southeast Asia, and Europe. Investigators described the operation as running in two distinct clusters: an “Expansion” team focused purely on compromising more routers and growing the botnet, and a second team handling the actual adversary-in-the-middle attacks and credential collection.
The takedown itself was unusual in its aggressiveness. Rather than simply publishing an advisory and asking device owners to update their firmware, the FBI obtained court authorization to remotely reach into the compromised routers themselves, reset their DNS configurations, and reconnect them to legitimate resolvers provided by their internet service providers — a similar approach to earlier law enforcement cleanup efforts against the VPNFilter and Cyclops Blink botnets.
It’s worth noting what that takedown didn’t do, though. It reset the DNS configuration on infected devices, but it didn’t patch whatever vulnerability or weak credential let the attackers in during the first place. Security researchers who covered the disruption pointed out that this kind of fix is necessarily temporary unless device owners also address the underlying exposure — the same warning that applies just as directly to the hotel and conference-venue gateways being exploited now.
The FrostArmada disruption also arrived alongside a broader U.S. regulatory response to router security concerns. Weeks earlier, on March 23, 2026, the Federal Communications Commission banned the import of new foreign-manufactured consumer routers into the United States, citing documented attacks by Russian and Chinese state-linked actors as evidence of a severe cybersecurity risk to critical infrastructure — a rule that hit TP-Link particularly hard given its roughly 65 percent share of the American home router market at the time.
Whether or not the hotel Wi-Fi campaign turns out to be run by the exact same operators, the FrostArmada story matters because it shows this isn’t a one-off idea. Turning ordinary internet infrastructure — routers, gateways, captive portals — into silent, DNS-poisoning credential harvesters is now a proven, repeatable playbook, one that’s been used at a scale of tens of thousands of devices across more than a hundred countries. The hotel campaign looks a lot like the same idea, redeployed against a different, and in some ways even more attractive, category of target.
Why Hotel and Conference Wi-Fi Is Such an Attractive Target
There’s a reason attackers would shift their focus from home routers to hospitality Wi-Fi gateways, and it comes down to concentration and trust.
A home or small-office router compromise nets an attacker access to one household or one small business. A single hotel or conference center Wi-Fi gateway, by contrast, might serve hundreds of guests a night — and at a conference venue, potentially thousands of attendees over the course of an event, many of them traveling executives, consultants, lawyers, and other professionals with exactly the kind of Microsoft 365 mailbox access that’s valuable to a state-linked espionage operation or a financially motivated crime group.
There’s also an implicit trust problem baked into how public Wi-Fi works. When a device joins a network, it simply accepts whatever DNS resolver that network hands it — there’s no built-in mechanism for a laptop to verify that the resolver it’s been given is trustworthy. Guests connecting to “Hotel_Guest_WiFi” have no way of independently confirming that the network’s DNS settings haven’t been quietly altered by someone who compromised the gateway weeks earlier. The entire hospitality Wi-Fi model runs on an assumption of good faith that, once broken at the gateway level, is essentially invisible to anyone downstream.
Business travelers also tend to be more vulnerable in subtle ways that have nothing to do with technical sophistication. Rushed itineraries, unfamiliar hotel booking systems, jet lag, and the pressure to clear an inbox before a meeting all combine to make people less likely to scrutinize a login page carefully — especially one that looks, at a glance, exactly like the Microsoft sign-in screen they’ve seen a thousand times before.
What’s at Stake If an Account Is Compromised
A stolen Microsoft 365 credential or OAuth token isn’t just an email inbox exposed. For a working professional, that single account often unlocks Outlook and calendar data, OneDrive and SharePoint files, Teams messages, and — if the organization uses Microsoft’s identity platform broadly, as most do — potentially a foothold into other connected business systems as well.
Beyond straightforward data theft, compromised accounts create secondary risks that are arguably worse. An attacker sitting inside a legitimate executive’s mailbox can impersonate that person convincingly, opening the door to business email compromise fraud, fake wire transfer requests, or further “internal” phishing emails sent to coworkers and clients who have every reason to trust a message that appears to come from a real colleague’s real account. For organizations in legal, financial, or healthcare sectors specifically — several of the industries ReliaQuest observed traffic from — that kind of access can also mean exposure of sensitive client data, privileged communications, or regulated health information.
And because the initial compromise leaves no malware trace on the victim’s device and no suspicious email in anyone’s inbox, these intrusions can go undetected for a long time. Security teams reviewing endpoint logs or email gateways for signs of compromise may simply find nothing, because there was nothing there to find — the theft happened entirely on the network side, at a hotel gateway the victim’s own IT department has no visibility into and no ability to monitor.
How Travelers Can Protect Themselves
None of this requires giving up on hotel and conference Wi-Fi altogether, but it does call for a shift in how business travelers think about “getting online” the moment they check in.
- Use a VPN on any public or hospitality network. A properly configured VPN encrypts your traffic and routes your DNS requests through your VPN provider rather than whatever resolver the hotel’s gateway hands you, which neutralizes this entire style of attack even if the gateway itself is compromised.
- Use your phone’s mobile hotspot for sensitive logins when possible. Tethering to cellular data sidesteps the hotel network’s DNS entirely for anything you access that way.
- Be suspicious of unexpected authorization or “device code” prompts. If a login flow asks you to approve something that doesn’t match what you were actually trying to do — especially a prompt referencing a device code you weren’t expecting to enter — stop and verify before approving.
- Check the address bar even when the page looks right. Lookalike domains like m365-owa[.]com or ms365-live[.]com are designed to be glanced past, not scrutinized, so a habit of actually reading the URL before entering credentials remains one of the simplest defenses available.
- Enable phishing-resistant authentication where your organization supports it. Passkeys and FIDO2 security keys are far harder to phish than a password-plus-code combination, precisely because they’re cryptographically tied to the legitimate site and won’t complete an authentication handshake with a lookalike domain.
What Hotels, Venues, and IT Teams Should Do
The venue side of this problem is arguably more important to fix than the traveler side, since a single hardened gateway protects every future guest rather than relying on each individual to be vigilant.
- Take Wi-Fi gateway administration off the open internet. Exposed SSH, SNMP, and web admin consoles are the presumed entry point in this campaign; management access should be restricted to a trusted internal network or VPN, not reachable from anywhere on the public internet.
- Replace default and reused administrative credentials. This sounds basic because it is — and it’s precisely the kind of basic gap researchers believe let attackers in without needing any novel exploit at all.
- Monitor DNS configurations on captive portal devices for unexpected changes. Regular auditing of gateway DNS settings can catch a hijack quickly rather than allowing it to run for weeks or months undetected.
- Corporate IT and travel security teams should treat hotel and conference Wi-Fi as inherently untrusted networks, mandating VPN use in travel policies and considering managed device configurations that enforce it automatically rather than leaving it to individual judgment in the moment.
- Apply the lessons of the FrostArmada takedown. That operation showed how quickly a DNS-hijacking campaign can scale once it finds a class of exposed, poorly monitored network devices — the same underlying lesson applies directly to hospitality and event Wi-Fi infrastructure, which has historically received far less security scrutiny than corporate networks.
The Bigger Picture
What makes this campaign worth paying attention to isn’t just the specific technique — DNS poisoning at a network gateway is not a new idea. It’s the target selection. By moving from home routers to the Wi-Fi infrastructure of hotels and conference centers, attackers have found a way to position themselves directly in the path of exactly the kind of high-value, frequently traveling professional targets that a state-linked espionage operation, or a financially motivated group borrowing its playbook, would most want access to — all without needing a single email to land in an inbox.
Whether this specific campaign is ultimately confirmed as APT28’s work or that of an unrelated group borrowing similar tradecraft, the broader trend it represents is clear: as email security and endpoint protection have matured, attackers are pushing their compromise further upstream, into the network infrastructure that both individuals and organizations tend to trust implicitly and monitor the least. The FrostArmada takedown proved that infrastructure-level DNS hijacking can run undetected at a scale of tens of thousands of devices for the better part of a year. The hotel Wi-Fi campaign suggests that lesson has already been absorbed and redeployed against a new, and in some ways more efficient, category of target.
For now, the most effective defense remains a fairly simple mental shift: treat the Wi-Fi network in your hotel room with the same skepticism you’d apply to an unsolicited email, because increasingly, it’s serving exactly the same purpose.