ReliaQuest's report, "ReliaQuest Identifies New Attack Vector Targeting Microsoft 365 Users Via Compromised Wi-Fi Gateways", details a sophisticated attack vector. This new threat, often manifesting as a hotel Wi-Fi DNS hijack, doesn't target user devices directly with malware. Instead, attackers compromise Wi-Fi gateways in hotels and conference centers, which are typically captive portal appliances managing guest network access. This invisible hijack of the network connection itself poses a significant risk to corporate travelers.
How a Hotel Wi-Fi DNS Hijack Works: Your Gateway Becomes the Enemy
The initial access vector for this hotel Wi-Fi DNS hijack involves exploiting exposed management interfaces like SSH, SNMP, or web administration panels. These interfaces, often left with default, weak, or reused credentials, become the Achilles' heel for many network devices. Attackers actively scan for and exploit these vulnerabilities, aligning with the MITRE ATT&CK techniques of Initial Access (T1078 - Valid Accounts, T1190 - Exploit Public-Facing Application). Once an attacker gains a foothold on the gateway, they can begin to manipulate its core functions.
Once inside, they alter the gateway's DNS settings. This is the core of the attack: DNS poisoning. Instead of resolving legitimate Microsoft 365 domains to Microsoft's secure servers, the compromised gateway directs every connected device to an attacker-controlled server. This redirection is seamless and often undetectable by the average user, as the browser still shows what appears to be a legitimate login page.
They use lookalike domains such as m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com. These domains are carefully crafted to mimic official Microsoft URLs, making them highly deceptive. When a user attempts to access their email or other Microsoft 365 services, they are unknowingly redirected to a fake Microsoft 365 login page. Entering credentials here hands them directly to the attacker, compromising their account instantly. This method is particularly insidious because it bypasses many traditional endpoint security measures, as the malicious activity occurs at the network layer before traffic even reaches the user's device.
The Sneaky MFA Bypass and WPAD Abuse
This attack escalates beyond simple password theft. These threat actors also exploit Microsoft Entra ID's device code authentication flow (formerly Azure AD) to bypass multi-factor authentication (MFA). This is a critical component of the hotel Wi-Fi DNS hijack that makes it even more dangerous.
Here's how the bypass works: A user lands on a deceptive Microsoft page, which, instead of a direct password prompt, might request approval for an authorization. If the user unknowingly approves this, the attacker obtains a legitimate OAuth token. This token grants access to the Microsoft 365 account without requiring the user's password or MFA code directly. It's a valid token, issued by Microsoft, but to the attacker's client application. This represents a significant security gap, categorized under Defense Evasion (T1556.006 - Multi-Factor Authentication: Device Registration), allowing attackers to maintain persistent access.
Additionally, in approximately one-third of cases observed by ReliaQuest, attackers attempted to abuse Windows' Web Proxy Auto-Discovery (WPAD) feature. Windows automatically searches for a PAC (Proxy Auto-Configuration) file to determine proxy settings. Attackers respond to this lookup with a malicious PAC file, which could theoretically reroute all application traffic from a Windows device, including browser traffic, through their proxy. This technique falls under Proxy (T1090). While ReliaQuest has not confirmed the success rate of this WPAD abuse, the intent to gain deeper control over network traffic and potentially intercept even encrypted communications is clear.
The underlying issue is that public DNS services, even Google's 8.8.8.8, often rely on unencrypted DNS traffic. If the local gateway is compromised, it can intercept and modify these requests before they leave the hotel network. Even endpoints configured for opportunistic DNS encryption can fall back to plaintext requests, leaving them exposed to this type of hotel Wi-Fi DNS hijack. This highlights a fundamental vulnerability in how many networks handle DNS resolution.
Who's Getting Hit, and Why It Matters
This campaign exhibits a broad geographic reach, affecting various US metropolitan areas, India, and Saudi Arabia. The targeting is strategic, focusing on employees within critical sectors such as finance, healthcare, legal services, energy, retail, and professional services. These sectors are prime targets where credential compromise can lead to substantial data breaches, intellectual property theft, and significant financial losses. The high value of data and access within these industries makes them attractive targets for sophisticated adversaries, often through methods like the hotel Wi-Fi DNS hijack.
The tradecraft exhibits similarities with techniques previously attributed to APT28, a Russian state-backed group, specifically the use of DNS poisoning and credential harvesting via lookalike domains, reminiscent of their 'FrostArmada' operations. However, this campaign distinguishes itself with a specific focus on hospitality Wi-Fi infrastructure and the use of different malicious domains and servers. The sophistication and target selection observed strongly suggest a well-resourced adversary, even without direct attribution. This evolution in attack vectors demonstrates attackers' adaptability and their continuous search for new vulnerabilities, including the hotel Wi-Fi DNS hijack.
The practical impact is that corporate travelers are vulnerable every time they connect to an untrusted Wi-Fi network. This is not a targeted spear-phishing email that can be easily identified; it's an invisible hijack of the network connection itself. Endpoint security solutions may not flag this activity because the malicious redirection occurs before traffic reaches the device's security controls. This makes detection and prevention particularly challenging, placing a greater burden on network-level defenses and user awareness, especially against a hotel Wi-Fi DNS hijack.
What We Need to Do About It
This attack demonstrates that simply advising "use a VPN" is insufficient if not configured correctly. It underscores the need for a layered defense strategy to combat the hotel Wi-Fi DNS hijack threat effectively.
To counter this, organizations must enforce an always-on, full-tunnel VPN, configured to route all traffic. This encrypts DNS requests, directly preventing local gateways from poisoning them, a core component of this attack. A full-tunnel VPN ensures that even DNS queries are protected from interception and modification. Furthermore, if your organization does not require Web Proxy Auto-Discovery, disabling WPAD is crucial, as it eliminates a legacy feature attackers are actively abusing to reroute traffic. This simple configuration change can close a significant attack vector against a potential hotel Wi-Fi DNS hijack.
Reviewing Microsoft Entra ID settings to block the device code authentication flow closes a critical MFA bypass vector that attackers are exploiting to obtain legitimate OAuth tokens. This specific configuration change can prevent attackers from leveraging this sophisticated MFA bypass. Beyond technical controls, monitoring authentication activity for connections originating from unknown proxy hosts or unusual geographic locations can flag compromised accounts early. Implementing robust Security Information and Event Management (SIEM) solutions can help correlate these suspicious activities and detect a hotel Wi-Fi DNS hijack.
Finally, while technical controls are paramount, user awareness plays a crucial active role; remind users to always verify URLs before entering corporate credentials, especially on public Wi-Fi. A vigilant user can still prevent compromise when other layers fail by recognizing subtle discrepancies in login pages. Enforcing strict encrypted DNS at the endpoint ensures DNS requests are always encrypted and cannot fall back to plaintext, even if the local network attempts to interfere. This could involve using DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) at the client level to prevent a hotel Wi-Fi DNS hijack.
The underlying vulnerabilities enabling these attacks are systemic and will persist. As long as public Wi-Fi networks remain inconsistently secured and organizations rely on legacy protocols, attackers will continue to exploit these weaknesses. We must move beyond endpoint patching and secure the network layers that users implicitly trust. This threat, particularly the hotel Wi-Fi DNS hijack, is demonstrably real and sophisticated, necessitating a more comprehensive defense strategy than many organizations currently employ. Proactive security measures and continuous education are essential to protect against these evolving threats.
