Hotel Wi-Fi Routers Compromised to Steal Corporate Login Credentials From Visitors

ReliaQuest warns of a global DNS poisoning campaign targeting public Wi‑Fi routers at hotels, conference centers and other venues frequented by corporate travelers; attackers exploit exposed management interfaces and weak/reused admin credentials to modify router DNS and transparently harvest usernames, passwords and other sensitive data. The activity, observed across multiple US cities, India and Saudi Arabia, is ongoing and described as similar to TTPs attributed to APT28; mitigations recommended include enforcing always‑on full‑tunnel VPNs, auditing proxy authentication logs, disabling WPAD, validating sites before entering credentials, and blocking device‑code authentication flows.