Hotel Wi-Fi Networks Hijacked to Steal Microsoft 365 Session Tokens in Global AiTM Espionage Campaign
Executive Summary
In July 2026, threat researchers at ReliaQuest disclosed an ongoing cyber espionage campaign targeting traveling corporate executives and mobile personnel across major hotel chains, conference centers, and public Wi-Fi venues in the United States, India, and Saudi Arabia. Operating since at least June 2026, the adversaries compromise internet-facing Wi-Fi gateway routers and poison local DNS responses, silently rerouting corporate traffic to spoofed Microsoft 365 authentication interfaces (such as m365-owa.com and ms365-live.com). Without relying on traditional phishing emails or malware attachments, the campaign intercepts corporate credentials, session cookies, and OAuth 2.0 refresh tokens, bypassing Multi-Factor Authentication (MFA) to grant threat actors persistent access to enterprise cloud environments.
Deep-Dive Technical Analysis
Gateway Compromise & Perimeter Access
Threat actors gain initial access to public Wi-Fi gateway devices by exploiting exposed management interfaces—including internet-facing SSH, SNMP, and administrative web consoles—running default, weak, or reused credentials. The tradecraft closely mimics patterns documented in Russian state-backed APT28 (Fancy Bear / UAC-0001) operations, specifically the "FrostArmada" router-targeting campaign.
DNS Poisoning & Resolver Manipulation
Once inside the gateway router, the attackers manipulate the local DHCP/DNS daemon. When connecting devices request domain resolution, the compromised gateway intercepts and rewrites DNS queries for legitimate Microsoft 365 endpoints, directing users to attacker-controlled Adversary-in-the-Middle (AiTM) proxy infrastructure. Standard endpoint mitigations fail under this design:
* Hardcoded Public Resolvers (e.g., 8.8.8.8): Unencrypted UDP/TCP port 53 DNS traffic sent to 8.8.8.8 still traverses the compromised gateway, where NAT rules or inline inspection rewrite the packet payload before it reaches external servers.
* Opportunistic Encrypted DNS: Many modern operating systems default to "opportunistic" DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT). When the compromised gateway blocks or drops encrypted handshake attempts, OS resolvers silently fall back to unencrypted plaintext DNS—which the gateway immediately redirects. Only "strict-mode" DoH/DoT prevents this fallback.
WPAD Protocol Abuse
In roughly one-third of observed cases on Windows and macOS endpoints, attackers abused Web Proxy Auto-Discovery (WPAD). By poisoning WPAD DNS requests (wpad.local), the gateway instructs connecting operating systems to download a malicious Proxy Auto-Configuration (wpad.dat) file. This routes all browser, authentication, and enterprise application traffic through an attacker-managed proxy, expanding the attack vector far beyond authentication pages.
AiTM Token Hijacking & Device-Code Phishing
When users attempt to access Microsoft 365, the AiTM proxy presents a mirror image of the official login portal while relaying authentication packets to genuine Microsoft endpoints. This allows the proxy to capture:
* User Credentials & Plaintext Passwords
* MFA Session Cookies & SAML Assertions
* OAuth 2.0 Refresh Tokens
In select high-value cases, attackers bypassed password prompts entirely by leveraging Microsoft's Device-Code Authentication Flow. The proxy presents a device code prompt to the victim; once the user completes the MFA prompt on their personal or corporate mobile device, a valid, MFA-cleared primary refresh token (PRT) is issued directly to the attacker's infrastructure.
Mobile Workforce & Executive Travel Threat Vectors
Corporate travel introduces significant security blind spots. Executive personnel routinely connect to untrusted network perimeters in hotels, airports, and convention centers, placing implicit trust in local network infrastructure. When gateway routers act as rogue proxies, traditional email gateway filters and endpoint detection agents fail to detect the interception because no malicious files or email links are introduced.
Furthermore, identity provider (IdP) session tokens remain valid across network boundaries unless explicit Conditional Access rules or Continuous Access Evaluation (CAE) policies enforce strict IP binding or device compliance checks.
Industry Impact & Actionable Mitigations
This campaign highlights systemic vulnerabilities in remote access architectures across finance, legal, healthcare, energy, and retail sectors. Security teams should deploy the following technical mitigations immediately:
1. Mandatory Full-Tunnel VPN / ZTNA Enforcers: Enforce always-on full-tunnel Virtual Private Network (VPN) or Zero Trust Network Access (ZTNA) solutions on all corporate endpoints. Split-tunneling exceptions for DNS must be disabled so that all name resolution queries are securely routed through corporate resolvers before reaching local network gateways.
2. Strict-Mode Encrypted DNS: Configure OS-level DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) in strict mode, explicitly disabling automatic fallback to unencrypted plaintext DNS.
3. Disable WPAD Globally: Disable Web Proxy Auto-Discovery (WPAD) via Group Policy (GPO) or MDM profiles across all Windows and macOS enterprise fleets.
4. Disable Device-Code Authentication: Block the Microsoft Device-Code authentication flow at the Entra ID / Azure AD level unless explicitly required for headless IoT devices.
5. Enforce Phishing-Resistant FIDO2 / WebAuthn MFA: Transition users to FIDO2 hardware keys or Passkeys. FIDO2 authentication cryptographically binds credentials to the exact domain origin (login.microsoftonline.com), preventing AiTM proxies on spoofed domains from completing the challenge.
6. Conditional Access & Continuous Access Evaluation (CAE): Enforce strict Entra ID Conditional Access policies requiring compliant, managed devices and real-time risk assessment via CAE to automatically revoke active session tokens upon network anomalies.
Sources and references:
* Security Affairs — Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Credentials