ReliaQuest: Resort Wi-Fi Attacks Steal Microsoft 365 Credentials

ReliaQuest uncovers a campaign exploiting public Wi-Fi at resorts/meeting centers to steal Microsoft 365 credentials via DNS poisoning. The attack bypasses typical endpoint security, targeting corporate visitors.

ReliaQuest has recognized a project targeting public Wi-Fi entrances at resorts and meeting centres to steal Microsoft 365 qualifications from corporate visitors. The task has actually been under way considering that at least June 2026.

How the Attack Works: DNS Poisoning

ReliaQuest stated the naming convention, shared registration information and panel functions aligned with the device-code abuse seen elsewhere in the project. It analyzed with medium self-confidence that the domain was planned to sustain even more Microsoft 365 account compromise activity.

The technique exploits a standard function of public networks: tools trust the network’s DNS resolver to provide accurate solutions when converting domain right into IP addresses. By managing the gateway, an aggressor can forge responses and silently straight customers to false destinations.

ReliaQuest evaluated with high confidence that the domains were run by the exact same actor as a result of shared registration details and because they showed up within the exact same browsing sessions only seconds apart in numerous cases.

The new campaign varies in numerous ways. It targets restricted portal devices utilized in hospitality and seminar setups as opposed to the router types seen in FrostArmada, makes use of different framework, and shows up to reroute all DNS demands instead of uniquely filtering system traffic by key phrases.

ReliaQuest evaluated with low-to-medium self-confidence that the first access may have included revealed administration user interfaces, such as internet-facing SSH, SNMP and web management consoles, integrated with weak or reused administrative qualifications. Presence limits on the tools indicated it can not validate that accessibility approach.

When in control, the assailant made use of DNS poisoning to send internet demands for genuine domain names to attacker-run servers. 4 domains – m365-owa [That likewise means typical endpoint defenses may stop working to quit the attack. Hard-coded public DNS solutions such as Google’s 8.8.8 [8 do not always secure customers since DNS demands still take a trip across the regional network in unencrypted type, enabling a harmful portal to intercept and alter them.

ReliaQuest stated two steps were effective against the method: a full-tunnel VPN that routes all traffic, including DNS, through the business network prior to it reaches the general public entrance, and stringent encrypted DNS setups without any alternative to plaintext traffic.

Comparing with Previous Campaigns

“A single jeopardized portal allows the risk actor calmly redirect customers’ web traffic without touching their tools. Every employee that attaches to that network is exposed-no phishing web link, no harmful add-on, no endpoint concession required,” claimed ReliaQuest.

ReliaQuest stated that method was not recorded in earlier coverage on FrostArmada, a campaign interrupted in April 2026 and attributed to APT28. Because earlier task, attackers were stated to have actually altered DNS settings on little workplace and office routers to redirect website traffic and steal Microsoft logins and OAuth tokens.

Targeting and Scope of the Campaign

Endangered gateways were located in several United States cities, along with in India and Saudi Arabia, generally in hotel and friendliness settings. Traffic to those entrances came from organisations in financial solutions, specialist services, legal, health and wellness treatment, retail and energy, suggesting the procedure targeted travelling workers rather than a single industry.

At the centre of the campaign are restricted portal tools beside visitor networks that control DNS and routing for linked customers. A single concession can provide an attacker the ability to redirect traffic for every single guest joining that network.

That additionally indicates typical endpoint securities might fail to stop the attack. Hard-coded public DNS services such as Google’s 8.8.8 [] 8 do not necessarily secure customers because DNS requests still travel across the regional network in unencrypted form, enabling a destructive portal to intercept and change them.

ReliaQuest said those distinctions may point to a much less mindful or less sophisticated driver, although the underlying tradecraft overlaps with the earlier procedure. It included that the absence of direct technological links indicated it was not associating the activity to APT28 itself.

Protective Measures Against the Threat

The activity looked like methods previously linked to APT28, the Russian army knowledge team additionally called Fancy Bear and Forest Blizzard. ReliaQuest cut short of direct acknowledgment, saying the assessment was based on overlapping strategies, treatments and methods instead of shared infrastructure or other difficult technical links.

In a smaller sized variety of situations, attackers combined DNS redirection with misuse of Microsoft’s device-code authentication circulation. ReliaQuest said that path can provide enemies MFA-satisfied access to Microsoft 365 without needing to catch credentials straight or decrypt verification web traffic.

As soon as in control, the enemy used DNS poisoning to send web ask for legitimate domain names to attacker-run web servers. Four domains – m365-owa [] com, owa-ms365 [] com, ms365-device [] com and ms365-live [] com – were made use of in Microsoft-themed lures and hosted on the IP addresses 31.57.243 [] 154 and 104.194.159 [] 150.

It offered always-on, full-tunnel VPN as the main protective control. Organisations utilizing that arrangement on business gadgets were properly safeguarded due to the fact that DNS requests would not be exposed to the endangered resort or meeting network.