Hacked Hotel Wi-Fi Used to Steal Guests’ Logins | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

A spying campaign is hijacking the Wi-Fi at hotels and conference centers in an effort to steal logins and authentication tokens from users, according to a cybersecurity vendor.

“Compromised Wi-Fi gateways were identified across multiple US cities and internationally in India and Saudi Arabia, primarily in hotel and hospitality organizations, with activity ongoing since at least June 2026,” says Florida-based ReliaQuest. 

The compromised Wi-Fi equipment was exploited to tamper with user traffic to the Domain Name System, the internet’s phone book. The result is DNS poisoning, a way to redirect users away from a legitimate website they want to visit to a hacker-controlled page, usually dressed up to look official. Specifically, the Wi-Fi gateways were configured to target attempts to access Microsoft authentication portals. 

“In cases ReliaQuest investigated, forged responses redirected clients to hosts serving what we assess with medium confidence to be Microsoft-impersonating pages, including owa-ms365[.]com and ms365-live[.]com,” the company’s report says. 

It’s unclear how the gateways were tampered with, but ReliaQuest says with “low-to-medium confidence” that the attackers likely gained admin access by targeting the remote management interfaces for the Wi-Fi equipment, which can be secured with weak or known passwords.  

The compromised Wi-Fi gateways enabled attackers to hack hotel guests and conferencegoers. “Every employee who connects to that network is exposed —no phishing link, no malicious attachment, no endpoint compromise required,” the cybersecurity vendor added. 

ReliaQuest suspects that notorious Russian state-sponsored hacking group FancyBear or APT 28 is behind the spying campaign because the tradecraft matches techniques in a Wi-Fi router-focused spying campaign disclosed in April that’s also been blamed on the same group.  

That said, ReliaQuest noted that the compromised Wi-Fi gateways at the hotels and conference centers re-routed “all DNS requests” to the malicious pages, “potentially an indicator of a less sophisticated or less careful actor than APT28.” The findings arrive after the FBI and US cyber authorities warned that a number of Russian state-sponsored hackers were targeting poorly configured and vulnerable devices, including Wi-Fi routers, across critical sectors.

Guests at hotels or conference centers can protect themselves by activating a VPN in full-tunnel mode on their computers. The virtual private network will encrypt all the internet traffic on the computer, including DNS queries, blocking any potential snooping over the Wi-Fi gateway. 

“Requiring all corporate devices to use an always-on VPN with full-tunnel configuration ensures all DNS requests route through trusted corporate resolvers, mitigating the attack vector,”  ReliaQuest notes. “Full-tunnel VPN routes all traffic, including DNS, through the corporate network before it ever reaches the hotel or public gateway, stopping the attack at its source.”

In this campaign, the attacker was also using the suspicious domains “m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com” to impersonate the Microsoft authentication portals.