A concerning trend has emerged where attackers are exploiting the vulnerabilities of public Wi-Fi infrastructure to facilitate widespread credential theft. Reports indicate that devices powering public Wi-Fi networks in various global locations—from hotels to conference centers—are being targeted. ### The Modus Operandi The core of this attack involves compromising the DNS (Domain Name System) settings of the Wi-Fi devices. By altering these settings, attackers can redirect users attempting to access legitimate websites to meticulously crafted fake login pages. For instance, a user trying to log into their email might instead be sent to a convincing, but fraudulent, replica site. ### Targeting High-Value Accounts While the method can be used for various credential types, there's a particular focus on high-value accounts. **BleepingComputer** has highlighted instances where attackers specifically targeted **Microsoft 365** accounts, underscoring the potential for significant corporate and personal data breaches. ### The Risk to Users and Organizations For IT security professionals, this attack vector presents a dual challenge. Users on public Wi-Fi networks often operate under a false sense of security, making them susceptible to these sophisticated phishing attempts. Organizations, in turn, face the risk of employee credentials being compromised, leading to unauthorized access to internal systems and sensitive data. ### Mitigation Strategies To counter this threat, both users and organizations must adopt robust security practices: * **VPN Usage**: Always use a trusted Virtual Private Network (VPN) when connecting to public Wi-Fi. A VPN encrypts your internet traffic, making DNS redirection less effective. * **DNS-over-HTTPS (DoH) / DNS-over-TLS (DoT)**: Configure devices to use secure DNS protocols, which encrypt DNS queries and responses, preventing tampering. * **Multi-Factor Authentication (MFA)**: Enable MFA on all accounts, especially for critical services like **Microsoft 365**. Even if credentials are stolen, MFA provides an additional layer of security. * **Browser Security**: Be vigilant for certificate warnings and carefully inspect URLs before entering credentials. Look for 'HTTPS' and the padlock icon. * **User Education**: Educate employees and users about the risks of public Wi-Fi and the signs of phishing attempts. This ongoing threat underscores the critical need for heightened awareness and proactive security measures when utilizing public networks.