Hackers have compromised hotel Wi-Fi gateways to redirect employees connecting to the network to fake Microsoft 365 login pages, enabling them to steal credentials and authorization tokens without phishing emails or malware. The attack, identified by ReliaQuest since June 2026 across multiple countries, involves DNS manipulation and may exploit weak administrator passwords on gateway devices. Using an always-on VPN that routes traffic through a company network can prevent these redirects, while employees should reject unexpected Microsoft login prompts on public Wi-Fi.
https://hackread.com/hackers-hotel-wi-fi-gateways-hijack-microsoft-365-accounts/