Hotel Wi-Fi Hacking Campaign Targets Guests' Logins
A recent cybersecurity report has revealed a campaign that hijacks hotel Wi-Fi networks to steal logins and authentication tokens from unsuspecting guests. The Florida-based cybersecurity firm ReliaQuest identified compromised Wi-Fi gateways in various locations, including multiple U.S. cities and internationally in India and Saudi Arabia, with malicious activity traced back to at least June 2026.
The attackers exploited vulnerabilities in Wi-Fi equipment to manipulate user traffic directed to the Domain Name System (DNS), effectively executing DNS poisoning. This technique redirects users from legitimate websites to hacker-controlled pages, often disguised to appear official. Specifically, the compromised gateways targeted users attempting to access Microsoft authentication portals.
ReliaQuest's investigation revealed that forged DNS responses led users to sites impersonating Microsoft, such as owa-ms365.com and ms365-live.com. While the exact method of gateway tampering remains unclear, ReliaQuest suggests that the attackers likely gained administrative access by exploiting weak or known passwords on the remote management interfaces of the Wi-Fi equipment.
The implications of this breach are significant, as any employee connecting to the compromised network is at risk, without the need for phishing links or malicious attachments. ReliaQuest suspects that the notorious Russian state-sponsored hacking group FancyBear, also known as APT 28, may be behind this campaign, given the similarities to previous Wi-Fi router-focused attacks attributed to the group. However, the nature of the DNS redirection suggests that the actor may be less sophisticated than APT 28.
This warning comes in the wake of alerts from the FBI and U.S. cyber authorities about Russian hackers targeting poorly configured devices, including Wi-Fi routers, across critical sectors. To mitigate the risk, hotel guests and conference attendees are advised to activate a VPN in full-tunnel mode on their devices. This setup encrypts all internet traffic, including DNS queries, effectively blocking potential snooping over compromised Wi-Fi gateways.
ReliaQuest emphasizes that requiring corporate devices to use an always-on VPN with full-tunnel configuration can ensure that all DNS requests are routed through trusted corporate resolvers, thus mitigating the attack vector. The attackers in this campaign also utilized suspicious domains such as m365-owa.com and ms365-device.com to impersonate Microsoft authentication portals, further complicating the threat landscape for users.
