Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

ReliaQuest has identified an ongoing global campaign where attackers change DNS on compromised hotel and conference Wi‑Fi gateways to redirect users to fake Microsoft 365 login pages (including use of device‑code OAuth flows to bypass MFA), affecting organizations across multiple sectors and regions; investigators found attacker‑registered phishing domains, attempted WPAD abuse, and recommend mitigations such as full‑tunnel VPN, encrypted DNS in strict mode, disabling WPAD, and disabling Device Code authentication when not required.