APT28-linked campaign hijacks hotel Wi-Fi for logins

ReliaQuest has identified a campaign targeting public Wi-Fi gateways at hotels and conference centres to steal Microsoft 365 credentials from corporate travellers. The activity has been under way since at least June 2026.

Attackers compromised captive portal appliances that manage guest internet access, then altered their settings to redirect users to infrastructure under the attackers' control. The technique let threat actors harvest credentials without sending phishing emails or infecting users' devices.

Compromised gateways were found in several US cities, as well as in India and Saudi Arabia, mainly in hotel and hospitality settings. Traffic to those gateways came from organisations in financial services, professional services, legal, health care, energy and retail, suggesting the operation targeted travelling employees rather than a single sector.

The activity resembled tactics previously linked to APT28, the Russian military intelligence group also known as Fancy Bear and Forest Blizzard. ReliaQuest stopped short of direct attribution, saying the assessment was based on overlapping tactics, techniques and procedures rather than shared infrastructure or other hard technical links.

Gateway access

At the centre of the campaign are captive portal devices at the edge of guest networks that control DNS and routing for connected users. A single compromise can give an attacker the ability to redirect traffic for every guest joining that network.

ReliaQuest assessed with low-to-medium confidence that the initial access may have involved exposed management interfaces, such as internet-facing SSH, SNMP and web administration consoles, combined with weak or reused administrative credentials. Visibility limits on the devices meant it could not confirm that access method.

Once in control, the attacker used DNS poisoning to send web requests for legitimate domains to attacker-run servers. Four domains - m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com and ms365-live[.]com - were used in Microsoft-themed lures and hosted on the IP addresses 31.57.243[.]154 and 104.194.159[.]150.

ReliaQuest assessed with high confidence that the domains were operated by the same actor because of shared registration details and because they appeared within the same browsing sessions only seconds apart in several cases.

Attack chain

The method exploits a basic feature of public networks: devices trust the network's DNS resolver to provide accurate answers when converting domain names into IP addresses. By controlling the gateway, an attacker can forge responses and silently direct users to false destinations.

That also means common endpoint protections may fail to stop the attack. Hard-coded public DNS services such as Google's 8.8.8[.]8 do not necessarily protect users because DNS requests still travel across the local network in unencrypted form, allowing a malicious gateway to intercept and alter them.

ReliaQuest said two measures were effective against the technique: a full-tunnel VPN that routes all traffic, including DNS, through the corporate network before it reaches the public gateway, and strict encrypted DNS settings with no fallback to plaintext traffic.

It presented always-on, full-tunnel VPN as the main defensive control. Organisations using that configuration on corporate devices were effectively protected because DNS requests would not be exposed to the compromised hotel or conference network.

Broader activity

Investigators also saw secondary activity alongside the DNS redirection. In about one-third of observed cases involving Windows devices without Web Proxy Auto-Discovery disabled, or Mac devices, attackers attempted to abuse WPAD to push traffic through a hostile proxy.

ReliaQuest said that tactic was not documented in earlier reporting on FrostArmada, a campaign disrupted in April 2026 and attributed to APT28. In that earlier activity, attackers were said to have altered DNS settings on small office and home office routers to redirect traffic and steal Microsoft logins and OAuth tokens.

The new campaign differs in several ways. It targets captive portal appliances used in hospitality and conference settings rather than the router types seen in FrostArmada, uses different infrastructure, and appears to redirect all DNS requests rather than selectively filtering traffic by keywords.

ReliaQuest said those differences may point to a less careful or less sophisticated operator, even though the underlying tradecraft overlaps with the earlier operation. It added that the lack of direct technical links meant it was not attributing the activity to APT28 itself.

Device-code route

In a smaller number of cases, attackers paired DNS redirection with abuse of Microsoft's device-code authentication flow. ReliaQuest said that path could give attackers MFA-satisfied access to Microsoft 365 without having to capture credentials directly or decrypt authentication traffic.

This activity was directly observed on ms365-live[.]com. A related domain, ms365-device[.]com, appeared to host an operator-facing administration panel for uploading pages, rotating content, managing files, tracking visitors and restricting access by IP address.

ReliaQuest said the naming convention, shared registration details and panel functions aligned with the device-code abuse seen elsewhere in the campaign. It assessed with medium confidence that the domain was intended to support more Microsoft 365 account compromise activity.

"A single compromised gateway lets the threat actor silently redirect users' traffic without touching their devices. Every employee who connects to that network is exposed-no phishing link, no malicious attachment, no endpoint compromise required," said ReliaQuest.