ReliaQuest’s findings and geographic scope
Security researchers at ReliaQuest identified a campaign in which attackers change the DNS settings on Wi‑Fi gateway devices at hotels and conference centers so that visitors are silently redirected to attacker-controlled infrastructure. The activity has been ongoing since at least June and affected devices were found in multiple U.S. cities as well as in other regions including India and Saudi Arabia.
ReliaQuest logged traffic from organizations across a wide set of industries—financial services, professional services, legal, health care, energy, and retail—indicating this is not a sector-specific phishing run but rather a broadly cast effort aimed at traveling employees who use venue Wi‑Fi.
Attack chain: DNS manipulation and fake Microsoft 365 login portals
According to ReliaQuest, the adversary obtains administrator access to a gateway—how initial access is achieved is unclear, but the researchers say the attackers could have exploited weakly protected, exposed management interfaces such as SSH, SNMP, or web admin dashboards, or leveraged device vulnerabilities. Once an attacker has admin access, they alter the gateway’s DNS configuration so DNS lookups for legitimate services resolve to infrastructure the attacker controls.
The attackers registered at least four domains to host fake Microsoft login portals: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. With the gateway DNS rewritten, users attempting to reach legitimate Microsoft 365 login pages are instead routed to the phishing pages and can be induced to submit credentials or follow attacker prompts.
Device-code authentication flow: a path to MFA bypass
ReliaQuest observed cases in which targets were redirected into a device-code authentication flow. In those instances the user sees a familiar Microsoft-style prompt; what the user cannot see is that approving the prompt authorizes a session initiated by the attacker. ReliaQuest notes that approving such a prompt can cause a legitimate OAuth token to be issued to the attacker’s client.
Crucially, the researchers say this sequence bypasses multi-factor authentication without the attacker needing to steal a password or intercept existing access tokens. The token issuance is legitimate from Microsoft's perspective, but it grants the attacker access to the victim’s Microsoft 365 session.
WPAD attempts, DNS resolvers, and limits of protection
In about one‑third of the investigated cases, the attackers also tried to abuse Web Proxy Auto‑Discovery (WPAD) by responding to Windows’ automatic WPAD lookup with a malicious proxy auto‑configuration (PAC) file. If successful, that would route traffic from Windows apps—including Chrome—through an attacker‑controlled proxy. ReliaQuest could not confirm whether those WPAD attempts succeeded.
ReliaQuest also emphasized that switching to a public DNS resolver such as Google’s 8.8.8.8 does not defeat this technique because the gateway forges the plain‑text DNS requests before they reach an external resolver. That makes protections that rely solely on the choice of recursive DNS ineffective when the gateway itself is compromised.
What this means for security teams, enterprise IT, and traveling employees
- Technologists and security teams: ReliaQuest recommends using an always‑on, full‑tunnel VPN and encrypted DNS configured in strict mode to prevent DNS responses and web traffic from being redirected by a compromised gateway. Teams should also disable WPAD, review gateway and authentication logs for suspicious activity, and consider disabling the Device Code authentication flow in Microsoft Entra ID where it is not required.
- Affected enterprises and procurement leaders: Organizations that send staff to conferences and hotels should treat venue Wi‑Fi as a high‑risk service and require VPN use for corporate sessions. They should also assess supplier and venue network security, and ensure that remote access is tied to controls that do not rely on local DNS integrity.
- Traveling employees and end users: Users should be aware that approving a familiar login prompt can, in some flows, grant an attacker a legitimate session token and bypass MFA. Public DNS choices like 8.8.8.8 will not protect a user if the venue gateway is already altering DNS responses.
ReliaQuest compared the activity to the FrostArmada router‑based campaigns that have been attributed to the Russian espionage group APT28 (also known as Fancy Bear, Forest Blizzard), but the initial vector for these hotel and conference‑venue gateway compromises remains unspecified. That open question—how the gateways were first accessed—matters because it affects which mitigations are most urgent for venue operators versus traveling clients.
The practical takeaway is direct: a compromised Wi‑Fi gateway can present the attacker with a nation‑scale lever to redirect corporate traffic into phish pages and to obtain legitimate OAuth tokens without intercepting credentials. Organizations that expect employees to use public or shared networks should assume the worst-case: defend with full‑tunnel VPNs, strict encrypted DNS, disabled WPAD, and tighter controls around device‑code flows for cloud authentication.
