As reported by Security Affairs, ReliaQuest's threat research team has documented a sophisticated campaign in which attackers are compromising Wi-Fi gateway infrastructure at hotels and conference centers to silently redirect guests toward convincing Microsoft 365 credential-harvesting pages. This is not a phishing email campaign. There is no suspicious attachment, no unusual sender address, no moment of hesitation — just a traveler connecting to what appears to be a legitimate hotel network and unknowingly handing over enterprise credentials.

Key Takeaway: As reported by Security Affairs, ReliaQuest's threat research team has documented a sophisticated campaign in which attackers are compromising Wi-Fi gateway infrastructure at hotels and conference centers to silently redirect guests toward convincing Microsoft 365 credential-harvesting pages.

Why This Attack Is Particularly Dangerous

What makes this campaign especially insidious is the implicit trust travelers place in hospitality Wi-Fi infrastructure. Corporate security awareness training heavily emphasizes phishing email vigilance, but comparatively little focus is placed on the network layer itself. When a guest connects to a hotel's Wi-Fi and is redirected to a login portal, that behavior is entirely expected — it mirrors the legitimate captive portal experience that travelers encounter dozens of times per year. Attackers are weaponizing that muscle memory.

Furthermore, the targeting of Microsoft 365 credentials is strategically precise. M365 accounts frequently serve as the master key to an organization's entire digital estate: email, SharePoint, Teams, OneDrive, Azure AD (Entra ID), and often single sign-on access to third-party SaaS applications. A single stolen credential — particularly from a senior executive or IT administrator traveling to a conference — can cascade into a full enterprise compromise within hours.

Who Is Most at Risk

Why This Attack Is Particularly Dangerous
Road warriors and executives: Frequent travelers at industry conferences, trade shows, and corporate summits are prime targets. Attackers likely select venues based on attendee profiles.
Organizations without phishing-resistant MFA: If your M365 tenant still relies on SMS-based or authenticator app push MFA, adversary-in-the-middle (AiTM) techniques can bypass it in real time.
Companies with overprivileged accounts: A compromised account with broad permissions — Global Admin, Exchange Admin, or extensive SharePoint access — dramatically amplifies the blast radius.
Industries with high travel profiles: Legal, financial services, consulting, government contractors, and healthcare organizations where sensitive data is routine cargo.

The Technical Mechanics Defenders Should Understand

This campaign almost certainly leverages a combination of techniques: gateway-level DNS hijacking or HTTP interception to redirect traffic before SSL is established, combined with AiTM proxy frameworks (tools like Evilginx2 or Modlishka are commonly used in this category) that can relay real Microsoft authentication flows while silently capturing session tokens. This means even users who complete a legitimate-looking MFA challenge may have their session cookies stolen — effectively handing attackers an authenticated session without needing the password or the MFA code at all.

The session token is the new password. Modern AiTM attacks don't need your credentials if they can steal your authenticated session. Conditional Access policies that validate device compliance and network context are essential countermeasures.

Shield53 Recommendations

For Security Teams and CISOs

  • Enforce FIDO2/passkey authentication for M365: Hardware security keys (YubiKey, etc.) and passkeys are phishing-resistant and cannot be intercepted by AiTM proxies. Prioritize deployment for privileged accounts and frequent travelers immediately.
  • Implement Conditional Access with Compliant Device requirements: Require Intune-managed, compliant devices for M365 access. An attacker's replayed session token from an unmanaged device will be blocked.
  • Enable Microsoft Entra ID Sign-in Risk Policies: Configure risk-based Conditional Access to flag or block sign-ins from unfamiliar locations, anonymous IPs, or atypical travel patterns.
  • Deploy Microsoft Defender for Cloud Apps (MCAS) anomaly detection: Session policies that detect impossible travel or token replay activity can provide rapid alerting.
  • Audit and restrict OAuth app consent: Post-compromise, attackers often register OAuth applications to maintain persistent access. Review tenant consent grant policies and limit user-level consent.
  • Include network-layer threats in security awareness training: Train employees to use a corporate VPN before any authentication attempt on untrusted networks, including hotel Wi-Fi.

For Travelers Right Now

  • Connect to your corporate VPN immediately upon joining any hotel or conference Wi-Fi — before opening any browser or application.
  • Use mobile hotspot tethering via your corporate device or personal phone as a safer alternative to hotel Wi-Fi for sensitive work.
  • Be suspicious of any Microsoft, Google, or corporate login page that appears during a captive portal redirect — legitimate portals should not ask for enterprise SSO credentials.
  • Report any suspicious redirect behavior to your IT security team immediately, even if you didn't enter credentials.

Broader Implications

This campaign is a signal that attackers are increasingly moving up the stack — from endpoint and email to network infrastructure — as traditional phishing defenses mature. The hospitality sector represents a soft underbelly of enterprise security: organizations have zero visibility into and zero control over hotel network infrastructure, yet their employees authenticate to critical systems across it daily. Until phishing-resistant authentication becomes universal, this attack surface will remain wide open. Security leaders should treat any uncontrolled network as actively hostile — because, as this campaign demonstrates, it very well may be.