Hotel Wi

Gbhackers •Mayura Kathir • July 24, 2026

Adversaries are silently hijacking Microsoft 365 accounts by compromising hotel and conference-center Wi-Fi gateways and poisoning DNS no phishing emails, malicious attachments, or endpoint malware required. ReliaQuest assesses that the tradecraft closely mirrors prior APT28-linked router campaigns, extending them into captive-portal infrastructure used by traveling corporate staff. Since at least June 2026, threat actors have […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials A DNS poisoning campaign has compromised hotel and conference center Wi-Fi gateways to steal Microsoft 365 login credentials from corporate travelers. The campaign has been active since at least June 2026, affecting multiple U.S. cities and regions in India and Saudi Arabia. Attackers redirect users to fake Microsoft login pages without requiring phishing emails or malware on devices. Cybersecurity firm ReliaQuest identified the threat, linking it to the Russian state-sponsored group APT28. The compromised gateways exploit weak management interfaces to alter DNS settings, enabling credential harvesting from unsuspecting users. Organizations across various sectors, including finance and healthcare, are at risk as employees connect to these networks. Recommendations include enforcing always-on, full-tunnel VPNs to mitigate the attack vector. 49 sources 79

Hotel Wi

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)