A phishing campaign active since at least June is turning hotel and conference center Wi-Fi gateways into credential traps for business travelers, according to cybersecurity firm ReliaQuest. The case for concern is real. It is also complicated by how ordinary the attack looks: the hotel's network name appears as expected, unrelated websites load without interruption, and a traveler rushing between meetings may notice nothing until after entering a work password.
How the gateway compromise works
Wi-Fi gateways control how connected devices reach the internet. Once attackers gain administrative access, they alter the gateway's Domain Name System settings. DNS translates a website name into the numerical address that routes traffic to the correct server. In this campaign, ReliaQuest found that attackers modify that process so a request for a legitimate Microsoft login page resolves to a site the attackers control instead. ReliaQuest identified compromised gateways across several U.S. cities, with organizations in financial services, professional services, legal, health care, energy and retail connecting through the affected equipment. The breadth of sectors points toward targeting by travel behavior rather than by industry.
What the attackers collect and how
ReliaQuest says the attackers registered at least four domains designed to resemble Microsoft portals, each containing familiar Microsoft terms. The fake pages can capture Microsoft 365 credentials. In some incidents the attackers deployed a device code authentication flow that presented what appeared to be a legitimate Microsoft authorization prompt. When a user approved it, Microsoft issued a valid OAuth token to the attacker's client. That token can grant account access without requiring the attacker to steal a password or intercept a one-time code, bypassing multifactor authentication because the user completes the approval. In roughly one-third of observed cases, attackers also attempted to abuse Web Proxy Auto-Discovery, or WPAD, with a malicious proxy configuration file. ReliaQuest could not confirm whether those WPAD attempts succeeded.
The counterargument: switching DNS resolvers is not enough
The read-through on the obvious fix is discouraging. Switching to a public resolver such as Google's 8.8.8.8 does not defeat this attack. ReliaQuest explains that traditional DNS requests travel in plain text, so a compromised gateway can forge the response before the request ever reaches the selected resolver. Encrypted DNS configured in strict mode offers stronger protection because the local gateway cannot read or alter those requests. A full-tunnel VPN routing all traffic through a trusted server adds another layer. A phone's cellular hotspot bypasses the hotel gateway entirely.
On balance
The risk is that the attack's warning signs are easy to miss under time pressure, and that the device code technique sidesteps the multifactor authentication controls many organizations treat as a reliable backstop. ReliaQuest recommends that organizations disable Microsoft Entra ID device code authentication where it is not operationally required, review login records for unusual locations and unfamiliar device approvals, disable WPAD on Windows systems where it is unnecessary, and investigate unexpected proxy configuration activity. The line to watch for travelers is an authorization prompt they did not initiate: that is the clearest signal the attack is already in progress.