Hackers are actively manipulating DNS settings on Wi-Fi devices within hotels and conference centers, rerouting users to malicious **Microsoft 365** phishing portals. This campaign, observed since at least June, poses a significant risk to organizations across various sectors, including financial services, professional services, legal, healthcare, energy, and retail. Cybersecurity firm **ReliaQuest** has pinpointed compromised Wi-Fi gateways in multiple U.S. cities, as well as international locations such as India and Saudi Arabia. The strategic targeting of devices in venues serving corporate events suggests an intent to gain access to sensitive business information, communications, and private documents belonging to traveling employees. "We observed traffic to these compromised gateways from organizations in a range of industries... confirming this isn't sector-specific targeting, but a campaign that highly likely goes after traveling employees wherever they connect," **ReliaQuest** stated. Researchers believe this activity bears resemblance to the **FrostArmada** router-based campaigns, which have been attributed to the Russian espionage group **APT28** (also known as **Fancy Bear** or **Forest Blizzard**). ### Attack Chain Unveiled The initial method of gaining access to the Wi-Fi appliances remains unclear. However, **ReliaQuest** suggests that attackers may be exploiting weakly protected, exposed management interfaces such as SSH, SNMP, or web admin dashboards, or leveraging existing vulnerabilities. Once administrative access is established, the threat actor modifies the gateway's DNS settings. This redirection funnels legitimate domain requests to attacker-controlled infrastructure. **ReliaQuest** identified at least four malicious domains registered for hosting fake **Microsoft** login portals: `m365-owa[.]com`, `owa-ms365[.]com`, `ms365-device[.]com`, and `ms365-live[.]com`. Users attempting to access legitimate **Microsoft** login pages are consequently directed to these phishing sites, where their credentials are then harvested. ### MFA Bypass and WPAD Abuse In some instances, researchers observed a device-code authentication flow. Targets were redirected to a fake **Microsoft** page prompting for approval. "What the user can't see is that approving the prompt authorizes a session initiated by the attacker," **ReliaQuest** explained. This method issues a legitimate **OAuth** token directly to the attacker's client, effectively bypassing **multi-factor authentication (MFA)** without stealing credentials or intercepting access tokens.  *Source: ReliaQuest* Approximately one-third of the investigated cases also involved attempts to abuse **Web Proxy Auto-Discovery (WPAD)**. Attackers responded to **Windows**' automatic **WPAD** lookups with malicious proxy auto-configuration (**PAC**) files. While theoretically capable of routing traffic from **Windows** applications, including **Chrome**, through an attacker-controlled proxy, **ReliaQuest** could not confirm the success of these particular attacks. It's important to note that using public DNS servers like **Google**’s **8.8.8.8** does not prevent this attack, as the gateway forges plain-text requests before they reach the intended resolver. ### Recommended Mitigations To safeguard against these sophisticated attacks, **ReliaQuest** strongly recommends the implementation of an always-on, full-tunnel VPN and encrypted DNS in strict mode. Additionally, organizations should consider disabling **WPAD**, regularly reviewing logs for suspicious activity, and disabling the Device Code authentication flow in **Microsoft Entra ID** when it is not explicitly required.