Back Feeds.4Sysops

Hotel Wi

Feeds.4Sysops •IT News • July 24, 2026

Attackers are compromising hotel and conference-center Wi-Fi gateways to redirect every connected guest toward counterfeit Microsoft 365 sign-in infrastructure. The campaign requires no phishing email, malicious attachment, or malware on the victim’s device, and can still capture credentials, authentication tokens, or authorized sessions. ReliaQuest found activity in multiple U.S. cities, India, and Saudi Arabia involving travelers from finance, legal, healthcare, energy, retail, and other sectors. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials A DNS poisoning campaign has compromised hotel and conference center Wi-Fi gateways to steal Microsoft 365 login credentials from corporate travelers. The campaign has been active since at least June 2026, affecting multiple U.S. cities and regions in India and Saudi Arabia. Attackers redirect users to fake Microsoft login pages without requiring phishing emails or malware on devices. Cybersecurity firm ReliaQuest identified the threat, linking it to the Russian state-sponsored group APT28. The compromised gateways exploit weak management interfaces to alter DNS settings, enabling credential harvesting from unsuspecting users. Organizations across various sectors, including finance and healthcare, are at risk as employees connect to these networks. Recommendations include enforcing always-on, full-tunnel VPNs to mitigate the attack vector. 49 sources 79

Extracted Entities

Hotel Wi

The full story

Extracted Entities

Attack Types (2)

Countries (2)

Industries (5)

MITRE ATT&CK (1)

Platforms (1)