This threat involves attackers gaining administrative access to Wi-Fi gateway devices at hotels and conference centers, likely through exploitation of weak or exposed management interfaces such as SSH, SNMP, or web admin dashboards. Once access is obtained, attackers modify the DNS settings on these devices to redirect legitimate Microsoft 365 login requests to attacker-controlled phishing domains (e.g., m365-owa.com, owa-ms365.com). The phishing pages capture credentials and can also exploit the Microsoft device-code authentication flow to obtain OAuth tokens without stealing credentials or access tokens directly, effectively bypassing MFA. The campaign affects organizations in diverse sectors and multiple countries, including the U.S., India, and Saudi Arabia. Attempts to abuse WPAD were also observed but not confirmed successful. Using public DNS servers does not prevent this attack because the compromised gateway forges DNS requests before they reach the resolver. ReliaQuest recommends full-tunnel VPNs, encrypted DNS, disabling WPAD, and disabling device-code authentication flow in Microsoft Entra ID as mitigations.

Successful exploitation allows attackers to hijack Microsoft 365 accounts of users connecting to compromised hotel or conference center Wi-Fi networks. This can lead to unauthorized access to sensitive business information, communications, and private documents. The attack bypasses multi-factor authentication by abusing the device-code authentication flow, increasing the risk of account compromise even for users with MFA enabled. The campaign is not sector-specific and targets traveling employees across multiple industries globally.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, ReliaQuest recommends using an always-on, full-tunnel VPN and encrypted DNS in strict mode to protect against DNS hijacking. Disabling WPAD is advised to prevent proxy auto-discovery abuse. Additionally, organizations should consider disabling the device-code authentication flow in Microsoft Entra ID if it is not required. Monitoring logs for suspicious activity on Wi-Fi gateways and securing management interfaces (e.g., disabling or hardening SSH, SNMP, and web admin dashboards) are prudent steps to reduce risk.