Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts

## Executive Summary Attackers are compromising DNS configurations on hotel and conference Wi‑Fi equipment to redirect Microsoft 365 login traffic to realistic spoofed portals that capture credentials. The campaign—reported by BleepingComputer—leverages default credentials, unpatched firmware, physical access, or social engineering; stolen credentials enable BEC, data exfiltration, lateral movement, and persistence. Recommended mitigations include always using a VPN on public Wi‑Fi, deploying FIDO2/passkeys, enforcing conditional access and sign‑in risk policies, changing default admin credentials, segmenting guest networks, and monitoring DNS configurations.