One Compromised Wi-Fi Gateway Can Redirect Every Hotel Guest to Attacker Controlled Servers

Reliaquest reported a widespread campaign in which attackers compromise hotel and conference captive-portal gateways (via exposed management interfaces or weak credentials) to poison DNS responses and redirect guests to attacker-controlled Microsoft 365 lookalike sites, harvesting credentials and abusing the device-code/OAuth flow to gain access despite MFA. The activity has been observed across multiple countries and sectors, includes specific IoCs (domains, IPs, registrant email), and the report provides defensive guidance: enforce always-on full-tunnel VPN, use strict DNS over HTTPS/TLS, disable WPAD, and block device-code authentication paths via Conditional Access.