Hotel and Conference Wi-Fi DNS Hijacks Used to Steal Microsoft 365 Credentials

What Happened

According to BleepingComputer, attackers are altering DNS settings on Wi-Fi devices at hotels and conference centers to redirect guests to fake Microsoft 365 login pages. The report describes this as an active campaign, though full technical details on the intrusion method into the network devices and the scope of affected locations were not specified in the available reporting.

Why It Matters

Business travelers and conference attendees routinely connect to hotel and venue Wi-Fi and log into Microsoft 365 for email and collaboration. A hijacked DNS setting at the network level means any user on that Wi-Fi can be silently redirected to a credential-harvesting page regardless of how careful they are about clicking links, since the malicious redirect happens at the infrastructure layer rather than through a phishing email or message. Stolen Microsoft 365 credentials can lead to business email compromise, internal phishing, data theft, and further lateral movement into corporate environments — particularly damaging when the victims are traveling executives or staff with elevated access.

What Defenders Should Watch For

• Advise traveling employees to use a trusted VPN with its own DNS resolution whenever connecting to hotel, conference, or other public Wi-Fi networks.
• Encourage verification of the URL and TLS certificate before entering Microsoft 365 credentials, especially on unfamiliar networks.
• Enforce phishing-resistant MFA (e.g., FIDO2/hardware security keys) on Microsoft 365 accounts so that captured passwords alone are insufficient for account takeover.
• Monitor for anomalous Microsoft 365 sign-ins following travel or conference attendance — unusual source IPs, impossible-travel alerts, or sign-ins from unfamiliar ASNs shortly after a known travel period are worth investigating.
• Consider DNS-over-HTTPS or a managed DNS client on corporate devices to reduce reliance on untrusted local network DNS configuration.

Developing Story

This is a net-new report and details are still emerging; df00tech has not independently verified the scope or specific tactics involved. For the original reporting, see BleepingComputer's coverage.