- BIST10011,577-1.87%
- USD49.58+0.05%
- EUR55.62+0.09%
- GOLD4,128.20-0.53%
- INTEREST37.00%-1.00
- BITCOIN83,621-0.48%
- October 22, 202611°
- BIST10011,577-1.87%
- USD49.58+0.05%
- EUR55.62+0.09%
- GOLD4,128.20-0.53%
- INTEREST37.00%-1.00
- BITCOIN83,621-0.48%
- October 22, 202611°
ReliaQuest discovers phishing scheme on US hotel Wi-Fi targeting Microsoft accounts
ReliaQuest revealed that hackers hijack hotel and conference center Wi-Fi gateways, redirecting business travelers to fake Microsoft 365 login pages. The attack, ongoing since June, can even bypass multi-factor authentication.
Cybersecurity firm ReliaQuest has detected a sophisticated phishing campaign targeting Wi-Fi networks of hotels and conference centers in many US cities. The attackers gained administrative access to the network gateways, redirecting business travelers to fake login pages for Microsoft 365 accounts. The campaign has been active since at least June.
DNS Settings Modified
After hijacking Wi-Fi gateways, hackers change the DNS settings. When users try to access a legitimate Microsoft login page, their browsers are redirected to a fake site controlled by the attackers. The attack is hard to detect because the device appears connected normally and other websites open without issue.
Fake Domains Using Microsoft Terms
According to ReliaQuest's findings, the attackers registered at least four fake domains containing Microsoft terms: m365-owa[. ]com, owa-ms365[. ]com, ms365-device[. ]com, and ms365-live[. ]com. These fake pages collect users' email addresses and passwords. Compromised accounts can provide full access to corporate emails, documents, and cloud services.
Multi-Factor Authentication Bypassed
The most striking aspect of the attack is its ability to bypass multi-factor authentication (MFA). In some cases, attackers used a more complex device code authentication flow. The user encounters an authorization prompt on a fake page. In the background, the hacker has already initiated a session. When the user approves the request, Microsoft issues a valid OAuth token to the attacker's client. This method can render MFA ineffective because the approval is performed by the user.
WPAD Exploitation Attempts
ReliaQuest also noted that attackers attempted to exploit Web Proxy Auto-Discovery (WPAD) in about one-third of cases. WPAD, a protocol Windows uses to automatically find network proxy settings, was targeted by responding with a malicious proxy configuration file. It is not yet confirmed whether these attempts succeeded.
Security Recommendations from Experts
Experts recommend taking the following precautions, especially when using hotel and conference Wi-Fi networks:
- Use a full-tunnel VPN: A VPN that encrypts all your internet traffic prevents your data from being intercepted.
- Prefer a mobile hotspot: For sensitive transactions, use your own mobile data instead of the hotel network.
- Verify login addresses: Carefully check the domain in the browser address bar before entering your password. Use a saved bookmark to access your corporate portal.
- Be cautious with device code requests: Treat code approval requests from an unfamiliar device with suspicion. If you encounter an unexpected request, consult your IT department.
- Keep your devices updated: Ensure your operating system, browser, and security software are up to date before traveling.
- Use strong security software: Antivirus programs can help detect phishing pages.
ReliaQuest also recommends that companies disable device code authentication in Microsoft Entra ID if it is unnecessary, and regularly review sign-in logs for anomalous activity.
Stay Updated with Ally Daily
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
