Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

ReliaQuest identified an active campaign (since at least June 2026) where attackers compromise hotel and conference Wi‑Fi gateways to alter DNS responses and redirect employees to Microsoft‑themed phishing pages (including domains like m365-owa.com and owa-ms365.com); the operation has impacted travelers from multiple sectors across several countries and has at times abused device‑code authentication and WPAD. Recommended mitigations include an always‑on full‑tunnel VPN and rejecting unexpected authentication prompts on public Wi‑Fi.