Widespread DNS Poisoning Campaign Targets Hospitality Sector

Researchers identified an active DNS poisoning campaign targeting public Wi-Fi gateways in hotels and conference centers to harvest corporate credentials from traveling employees by compromising routers via weak admin credentials and exposed management interfaces; the campaign has been active since at least June 2026 across multiple US cities, India, and Saudi Arabia, impacting financial services, healthcare, and retail, and defenders are advised to enforce always-on, full-tunnel VPNs for corporate devices.