Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts

In July 2026, cybersecurity firm ReliaQuest identified a campaign where attackers compromised Wi-Fi devices in hotels and conference centers to hijack DNS settings. This manipulation redirected users attempting to access legitimate Microsoft 365 login pages to attacker-controlled phishing sites, leading to credential theft. The campaign, active since at least June 2026, affected various sectors, including financial services, healthcare, and retail, across multiple countries such as the U.S., India, and Saudi Arabia. The attackers exploited weakly protected management interfaces or unpatched vulnerabilities in Wi-Fi gateways to gain administrative access and alter DNS configurations. This method allowed them to intercept sensitive business information and communications without direct access to the victims' devices. (bleepingcomputer.com)

This incident underscores the evolving tactics of threat actors, who are increasingly targeting network infrastructure to bypass traditional endpoint security measures. The use of DNS hijacking to facilitate adversary-in-the-middle attacks highlights the need for organizations to secure all network devices, including those in transient environments like hotels and conference centers. Implementing robust security practices, such as using always-on, full-tunnel VPNs and encrypted DNS, is crucial to mitigate such threats. (bleepingcomputer.com)

The recent DNS hijacking campaign targeting hotel Wi-Fi networks demonstrates a significant shift in cyberattack strategies, emphasizing the vulnerability of public and semi-public network infrastructures. As remote work and business travel continue to rise, employees frequently rely on such networks, increasing the risk of credential theft and unauthorized access to corporate resources. Organizations must prioritize securing network access points and educating employees on safe connectivity practices to prevent similar incidents.