Public Wi‑Fi DNS Poisoning: Hijacking Microsoft 365 Sessions of Business Travelers
Public Wi‑Fi DNS Poisoning: Hijacking Microsoft 365 Sessions of Business Travelers 1. Basic Information Article Title : Hacked Public Wi-Fi Gateways Used to Harvest Corporate Credentials Source : SecurityWeek Publication Date : 2026-07-27 Original Article : https://www.securityweek.com/hacked-public-wi-fi-gateways-used-to-harvest-corporate-credentials/ Primary Source : https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/ Related Entities : Microsoft 365, Entra ID device-code flow, DNS poisoning, AiTM, WPAD, captive portal, FrostArmada, APT28 (attribution unconfirmed) Severity : High IOCs : 38.146.28.75 , 31.57.243.154 , 104.194.159.150 , m365-owa.com , owa-ms365.com , ms365-device.com , ms365-live.com 2. Executive Summary This attack compromises Wi-Fi gateways at locations like hotels to forge DNS responses. It does not send phishing emails. Instead, it tricks users into visiting fake Microsoft pages, using WPAD proxies, and entering device-code authentication. This allows attackers to steal MFA-authenticated Microsoft 365 sessions. 3. Attack Flow Chain A: DNS Redirection and Credential Theft Attackers gain administrative access to captive portal gateways in hotels or conference centers. Hypothesis (Primary source confidence: Low to Medium) : Public SSH/SNMP/Web management interfaces and weak, reused administrator credentials are used for initial access. The gateway returns fake responses for DHCP-assigned DNS or passing DNS, resolving normal domains to attacker IPs. Users are redirected to fake Microsoft pages to collect credentials and OAuth information. Attackers log into Microsoft 365 using the stolen credentials and tokens. Chain B: WPAD The gateway controls wpad name resolution or DHCP option 252. The device downloads the attacker's PAC file. Windows app and browser traffic pass through the attacker's proxy. Investigations observed attempts, but successful execution is unconfirmed. Chain C: Device-Code Flow The fake page sh