Hackers Hijack Hotel Wi-Fi DNS to Phish Microsoft 365 Accounts
Summary
ReliaQuest reports a campaign hijacking hotel and conference-center Wi-Fi gateways to redirect users to fake Microsoft 365 login pages. Device-code phishing may bypass MFA; WPAD abuse was observed but not confirmed successful.
Key points
- Attackers have changed DNS settings on compromised hotel and conference-center Wi-Fi gateways to redirect users to fake Microsoft 365 login pages.
- ReliaQuest says the activity has been ongoing since at least June and observed affected gateways in multiple U.S. cities, India, and Saudi Arabia.
- The campaign has touched organizations across several industries; ReliaQuest says it likely targets traveling employees rather than a specific sector.
- ReliaQuest assesses the activity as similar to FrostArmada campaigns attributed to APT28; this is an assessment, not confirmed attribution.
- In observed device-code phishing cases, approving a prompt could authorize an attacker-initiated session and issue an OAuth token to the attacker’s client, bypassing MFA.
- Attackers attempted WPAD abuse in about one-third of investigated cases, but ReliaQuest could not confirm whether it succeeded.
- ReliaQuest recommends an always-on full-tunnel VPN, strict encrypted DNS, disabling WPAD, reviewing logs, and disabling unused device-code authentication in Microsoft Entra ID.
Article Details
- Event Type
- DNS hijacking and phishing campaign targeting users of hotel and conference-center Wi-Fi
- Impact
- Users are redirected to fake Microsoft 365 login pages, where attackers can obtain credentials. ReliaQuest says device-code authentication abuse can let attackers obtain an OAuth token and bypass MFA. The compromised gateways could expose sensitive business information, communications, and documents; the success of the reported WPAD proxy attempts was not confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | m365-owa[.]com | Domain the attackers reportedly registered to host a fake Microsoft login portal. |
| DOMAIN | ms365-device[.]com | Domain the attackers reportedly registered to host a fake Microsoft login portal. |
| DOMAIN | ms365-live[.]com | Domain the attackers reportedly registered to host a fake Microsoft login portal. |
| DOMAIN | owa-ms365[.]com | Domain the attackers reportedly registered to host a fake Microsoft login portal. |
MITRE ATT&CK
Threat Actors
APT28ReliaQuest says the activity resembles router-based campaigns attributed to APT28; the article does not confirm APT28's involvement in this campaign.Fancy BearThe article identifies Fancy Bear as an alternate name for APT28, to which similar router-based campaigns have been attributed; involvement in this campaign is not confirmed.
Vendors
Products
Microsoft 365 Apps for EnterpriseHackers are compromising hotel and conference center Wi-Fi gateways to alter DNS settings and redirect users to fake Microsoft 365 login pages, with activity linked to multiple regions and industries.Microsoft Entra IDAdditionally, the cybersecurity company recommends disabling WPAD, reviewing logs for suspicious activity, and disabling Device Code authentication flow in Microsoft Entra ID when not needed.
Countries
Industries
EnergyThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.Financial ServicesThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.HealthcareThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.LegalThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.Professional ServicesThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.RetailThe campaign has been ongoing since at least June and impacts organizations in various sectors, including financial services, professional services, legal, health care, energy, and retail.