--- title: Hackers are compromising hotel Wi-Fi gateways to hijack... description: Threat actors have been compromising captive Wi-Fi gateways at hotels and conference centers since at least June to hijack Microsoft 365 accounts via DNS... canonical: https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts | daily.dev og:description: Threat actors have been compromising captive Wi-Fi gateways at hotels and conference centers since at least June to hijack Microsoft 365 accounts via DNS... og:url: https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc og:image: https://api.daily.dev/og/posts/Zlebdgeyc.png og:image:alt: Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary Threat actors have been compromising captive Wi-Fi gateways at hotels and conference centers since at least June to hijack Microsoft 365 accounts via DNS poisoning. By gaining admin access to these gateways through weak credentials and exposed interfaces, attackers silently redirect authentication traffic to attacker-controlled domains without touching user devices. Four Microsoft-impersonation domains were identified, with victims spanning professional services, finance, legal, healthcare, and energy sectors across the US, India, and Saudi Arabia. Using a 'safe' DNS provider or DNSSEC alone is insufficient since the gateway controls the path before queries reach any resolver. ReliaQuest recommends enforcing full-tunnel VPNs on corporate devices, deploying encrypted DNS (DoH/DoT) in strict mode, blocking device-code authentication flows in Entra ID, and disabling WPAD via Group Policy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-voqfhigtw) · Schneier on Security · 0 upvotes · 0 comments - [Beyond the Perimeter: How I Bridge WiFi VLANs to Hijack Your Domain Controller](https://daily.dev/posts/beyond-the-perimeter-how-i-bridge-wifi-vlans-to-hijack-your-domain-controller-4gpviklvc) · InfoSec Write-ups · 1 upvotes · 0 comments - [GhostCode attackers hijack Microsoft 365 accounts with device codes](https://daily.dev/posts/ghostcode-attackers-hijack-microsoft-365-accounts-with-device-codes-czidg2xfc) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts","url":"https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc"},"datePublished":"2026-07-28T02:28:48.606Z","dateModified":"2026-08-04T00:23:08.538Z","description":"Threat actors have been compromising captive Wi-Fi gateways at hotels and conference centers since at least June to hijack Microsoft 365 accounts via DNS...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e8f9b30144515adbb4af11a8ffd98cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e8f9b30144515adbb4af11a8ffd98cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-are-compromising-hotel-wi-fi-gateways-to-hijack-microsoft-365-accounts-zlebdgeyc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,vpn","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Hackers are compromising hotel Wi-Fi gateways to hijack Microsoft 365 accounts"}]} ```