Warning: Compromised Hotel Routers Send Users to Phishing Sites

ReliaQuest observed a campaign where compromised hotel Wi‑Fi routers are used for DNS poisoning to redirect travelers to Microsoft 365 phishing/authorization pages that capture OAuth tokens (via the device-code flow), allowing attackers to gain MFA-satisfied access to accounts; activity has been seen across the U.S., India, and Saudi Arabia and affects multiple industries.