Hotel Wi-Fi Networks Targeted in Phishing Attacks Aimed at Microsoft Logins

Cybersecurity firm ReliaQuest has identified a phishing campaign actively targeting business travelers by compromising Wi-Fi equipment in hotels and conference centers. The attackers gain administrative access to Wi-Fi gateways and alter their Domain Name System (DNS) settings. This allows them to redirect users attempting to access legitimate Microsoft login pages to fraudulent sites controlled by the hackers.

The campaign, which has been active since at least June, has impacted organizations across various sectors, including financial services, professional services, legal, health care, energy, and retail. Researchers found compromised Wi-Fi gateways in several U.S. cities, suggesting the attackers are targeting traveling employees broadly rather than a specific industry.

How the Attack Works

Once hackers compromise a Wi-Fi gateway, they can manipulate its DNS settings, which act as an internet address book. When a user tries to access a legitimate Microsoft login page, the altered DNS settings can reroute their browser to a fake site. Users may not notice any anomalies, as their devices can still appear to be connected normally, and other websites may continue to load.

Attackers have registered several domains designed to mimic legitimate Microsoft portals, including variations of "m365-owa," "owa-ms365," "ms365-device," and "ms365-live." These closely resemble official addresses, potentially deceiving users into entering their Microsoft 365 credentials.

Bypassing Security Measures

Some attacks have employed a more sophisticated method involving a device code authentication flow. In these instances, a user might see an authorization prompt that appears to be part of a legitimate sign-in process. However, the hacker may have already initiated an authentication session, and the user's approval grants the attacker a legitimate OAuth token. This technique can potentially bypass multifactor authentication because the system registers a valid authorization, even though it was initiated by the attacker.

Researchers also observed attempts to exploit Web Proxy Auto-Discovery (WPAD), a feature that allows Windows to automatically find network proxy settings. Attackers may attempt to respond to WPAD requests with malicious configuration files, which could potentially allow them to observe or manipulate network traffic. ReliaQuest could not confirm if these WPAD attempts were successful.

Protection Measures

To mitigate the risks associated with public Wi-Fi, security experts recommend several precautions for travelers:

• Use a Virtual Private Network (VPN): Employing an always-on, full-tunnel VPN encrypts internet traffic, routing it through a trusted server and protecting it from compromised networks. Ensure the VPN covers all traffic, not just selected applications.
• Utilize a Phone Hotspot: Using a cellular hotspot from a smartphone can help users avoid hotel Wi-Fi networks altogether. Users should monitor their mobile data allowances, as large downloads or video calls can consume significant data.
• Verify Login Pages: Before entering credentials, users should carefully examine the full web address of any login page. Using saved bookmarks for legitimate portals or opening official applications directly can prevent users from being directed to fake sites.
• Exercise Caution with Device Code Requests: Users should not approve unfamiliar device code prompts without verification. It is advisable to contact a company's IT or security department if a prompt seems unexpected.
• Maintain Updated Software: Keeping operating systems, browsers, and security software updated can patch vulnerabilities that attackers might exploit. Restarting devices after updates is crucial for some fixes to take effect.
• Employ Strong Security Software: Antivirus software with web protection features can help detect malicious pages and suspicious downloads, adding an extra layer of security.
• Company IT Review: Organizations can enhance security by reviewing Microsoft Entra ID settings, potentially disabling device code authentication if not required, and monitoring login records for suspicious activity. IT teams can also investigate unexpected proxy configuration changes on Windows devices and disable WPAD where unnecessary.

By understanding these threats and implementing protective measures, travelers can better safeguard their sensitive information when using public Wi-Fi networks.