# The Hotel Internet You Trusted Just Handed Your M365 Login to Moscow
The conference room is full of financial executives. The hotel Wi-Fi password is written on the whiteboard. Someone opens their laptop, connects, pulls up Outlook — and without knowing it, they've just handed a nation-state operative a legitimate OAuth token to their corporate email account.
That's not a hypothetical. That's a campaign ReliaQuest has been tracking since at least June 2026, running across hotels and conference centers in multiple U.S. cities, India, and Saudi Arabia.
## What's Actually Happening at the Gateway Level
The attack starts before you ever open a browser. Whoever is behind this gains administrative access to the Wi-Fi gateway — the box that routes internet traffic for the entire hotel or venue — and rewrites its DNS settings. From that moment on, every guest who connects and tries to reach a Microsoft login page gets silently redirected to one of four attacker-controlled phishing domains: m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, or ms365-live[.]com.
Here's the part that should make every IT team nervous: switching to Google's 8.8.8.8 as your DNS server won't save you. The gateway intercepts plaintext DNS queries before they ever reach the intended resolver. The compromise is upstream of any client-side DNS configuration you can set.
ReliaQuest doesn't have confirmed evidence of how initial gateway access was obtained, but the candidates are familiar: exposed SSH or web admin dashboards, weak credentials on management interfaces, or unpatched firmware vulnerabilities. This is not zero-day sophistication. This is neglected perimeter hygiene on hardware that every hotel property manager assumes someone else is securing.
## The MFA Problem Nobody Wants to Say Out Loud
Password theft is table stakes. What makes this campaign distinctive is the device-code authentication abuse.
In some observed cases, victims weren't shown a traditional credential-harvesting page. Instead, they were redirected to what appeared to be a legitimate Microsoft page displaying a device code prompt — the kind of flow you'd recognize from signing into an app on a smart TV or game console. The user sees a familiar interface, enters or approves the code, and completes what feels like a normal authentication step.
What they can't see is that the code was generated by an attacker-initiated OAuth session. When the user approves it, a legitimate Microsoft OAuth token gets issued — not to the user's device, but to the attacker's client. No credential was stolen. No MFA was intercepted. The attacker now holds a valid session token that Microsoft's infrastructure blessed, because the user authorized it.
This is a meaningful distinction. Most MFA deployment assumes the threat model is credential theft plus code interception. Device-code abuse sidesteps both. The user's password is never captured. The one-time code is never stolen. Yet the result is full account access that can persist long after the user disconnects from the hotel Wi-Fi and flies home.
## Who's on the Other End of This
ReliaQuest draws a careful comparison to FrostArmada, a campaign attributed to APT28 — the Russian military intelligence unit also known as Fancy Bear or Forest Blizzard. The behavioral and infrastructure overlap is notable enough that the researchers flag it, while stopping short of a firm attribution claim.
APT28 has a long history of targeting traveling executives and diplomatic staff. The unit compromised hotel Wi-Fi networks across Europe before major summits and events as far back as 2017. The operational logic is sound: conference centers aggregate high-value targets from multiple organizations in one place, all sharing the same compromised gateway. You don't need to penetrate each company individually. You compromise one device and collect credentials from an entire industry summit.
The sectors ReliaQuest observed in victim traffic — financial services, legal, healthcare, energy, retail — aren't targeted because of what those industries do. They're targeted because their people travel to conferences. This is geography-based opportunism, not sector-specific intelligence collection. Though the resulting access is anything but random.
## What the WPAD Twist Reveals
In roughly one-third of the investigated cases, attackers attempted a second technique: responding to Windows' automatic WPAD (Web Proxy Auto-Discovery) lookup with a malicious PAC file. This would theoretically route all Windows application traffic — including Chrome — through an attacker-controlled proxy.
ReliaQuest couldn't confirm these WPAD attempts succeeded. But their presence matters. A threat actor who's already compromised the gateway and running a convincing phishing overlay doesn't need WPAD unless they want more than Microsoft credentials. If WPAD payloads had worked, they'd have visibility into potentially everything the victim's machine transmitted, not just M365 sessions. The attempt reveals ambition.
---
## HackWire Analysis
The device-code authentication bypass deserves more attention than it's getting in the current coverage cycle. Most organizations hardened their MFA posture after the 2022-2023 wave of MFA fatigue attacks — push bombing, real-time phishing proxies, the EvilProxy ecosystem. They responded by requiring number matching, switching to FIDO2 keys, and training users on suspicious push approvals. That hardening is real and it matters.
But device-code flow attacks operate on a different threat model. They don't need to intercept a push notification. They don't need the user to approve an unexpected prompt. They need the user to approve a prompt they've been socially engineered to expect — because they think they're logging into a legitimate Microsoft portal. The phishing surface shifts from "don't approve unexpected push notifications" to "don't authenticate when DNS may be compromised," which is a much harder behavioral ask of a road warrior connecting from a hotel lobby.
The concrete action Microsoft tenants can take right now is disabling Device Code authentication flow in Entra ID Conditional Access unless it's actively required for specific device scenarios. Most enterprises have it enabled because it's on by default and device-code flows appear in legitimate use cases. That default posture is what this campaign exploits at scale.
The APT28 comparison also deserves scrutiny as a policy matter, not just a threat intelligence one. If this is indeed state-sponsored activity targeting Western financial, energy, and legal sectors from hotels in Saudi Arabia and India, we're looking at a campaign that operates in jurisdictions where attribution is contested and takedown requests are slow. The infrastructure can stay operational for months. The campaign has already been running since June with hotel gateways still compromised.
Security teams whose employees travel to industry events should be treating hotel and conference Wi-Fi as adversarial infrastructure by default — not as a convenience risk that VPN mitigates. Full-tunnel always-on VPN with encrypted DNS in strict mode is the right posture. So is a hard conversation with vendors about why conference venue network hardware has internet-exposed management interfaces at all.
The most underreported detail in this story is the venue's liability. These are compromised devices on property managed by hotels. Every guest who authenticated through those gateways was potentially victimized. We don't yet know whether any venue operators were notified, or what their legal exposure looks like when the OAuth token their misconfigured router issued gets used to exfiltrate a law firm's client documents.
That's the question the next wave of reporting needs to answer.
— HackWire Editorial
---
## Related Coverage