Enterprise employees traveling for work should think twice before logging into public Wi-Fi networks. According to a recent report by the ReliaQuest Threat Research team, threat actors have been compromising captive Wi-Fi gateways at hotels, conference centers, and shared venues since at least June to hijack Microsoft 365 accounts.
Once attackers gain control of a gateway, they can silently redirect user traffic to their own infrastructure. This allows them to steal credentials without ever touching the user’s device, compromising endpoints, or sending phishing links. The attack exploits the inherent trust devices place in DNS to route traffic, turning a single gateway compromise into a mass credential theft opportunity.
“The most dangerous element is that it operates at the network gateway, which sits beneath most of the trust assumptions users and devices make,” ReliaQuest told CSO Online. “It’s not necessarily an enterprise breach level event on its own, but it’s a very real risk to individual accounts.”
How the DNS Poisoning Attack Works
The campaign relies on DNS poisoning, a technique where false data is injected to redirect web traffic to fraudulent domains. While previously observed on small office routers, attackers are now scaling this to higher-level targets like hospitality network infrastructure.
Attackers likely gain access through weak or reused admin credentials combined with exposed management interfaces such as SSH, SNMP, and web consoles. Admin access to the gateway is all that is needed, as devices inherently trust DNS responses. By providing fake IP addresses for domains like login.microsoftonline.com, attackers can intercept every guest’s traffic without interacting with endpoints directly.
“Captive portal appliances sit at the network perimeter for every guest on that network,” the researchers wrote. “Detection is inherently difficult because the attack happens gateway-side, outside the endpoint’s visibility.”
In the tracked campaign, four attacker-registered domains were used for Microsoft-impersonation lures: m365-owa.com, owa-ms365.com, ms365-device.com, and ms365-live.com. Compromised gateways have been discovered across multiple US cities, as well as in India and Saudi Arabia, affecting users from professional services, financial services, legal, retail, healthcare, and energy sectors.
Why Standard Defenses Fall Short
Many organizations assume that locking network configurations to a “safe” DNS provider like Google (8.8.8.8) or Cloudflare (1.1.1.1) is sufficient. However, ReliaQuest contends this is not enough. By default, devices send DNS queries as unencrypted protocol traffic. These packets still traverse the hotel’s network to reach the chosen resolver, allowing the gateway to inspect, block, or redirect the query before it arrives.
“Specifying a trusted DNS server changes the intended destination, not who controls the road to get there,” ReliaQuest noted.
Furthermore, Domain Name System Security Extensions (DNSSEC) only partially address the problem. DNSSEC uses digital signatures to provide authentication and integrity, allowing validating resolvers to detect forged responses. However, it does not provide confidentiality or availability. It does not encrypt DNS traffic or stop an attacker from intercepting, blocking, or redirecting requests.
While DNSSEC can defeat certain response-forgery attacks against signed zones, an on-path gateway can still see queries, drop them, or force fallback behavior. This protection only helps when domains are actually signed and when the client or resolver performs validation, which many stub resolvers do not.
Required Actions for Enterprises
To combat this threat, enterprises should require all corporate devices to use a full-tunnel VPN for network connections. Controls should prevent internet access until a tunnel is active. This routes all device traffic, including DNS, through an encrypted connection to a trusted VPN server before it travels elsewhere, preventing local networks from modifying traffic.
“In effect, it takes the untrusted network out of the trust equation,” ReliaQuest noted. However, full-tunnel configuration is not the default due to trade-offs like added cost, latency, and bandwidth demands. Forcing all traffic through the corporate backbone is not always practical for distributed or bandwidth-heavy workforces.
Enterprises should also enforce conditional access in Entra ID to block the device-code authentication flow, which has few legitimate use cases for most users. Additionally, organizations should restrict Proxy Auto-Configuration (PAC) file retrieval to approved internal hosts and disable automatic Web Proxy Auto-Discovery (WPAD) via Group Policy, as it is often enabled by default in Windows.
What Travelers Should Do
For employees on the road, prevention is more critical than detection. While tools like Microsoft Defender for Endpoint can show ‘DnsConnectionInspected’ events for queries to attacker-controlled domains, these events typically fire after the redirect has already occurred. Endpoint telemetry confirms what happened more than it prevents it.
Therefore, methods like encrypted transport, Conditional Access, and WPAD/PAC hardening matter more than detection alone. Travelers should also train themselves to verify the URL and certificate of any page requesting credentials before entering them, particularly on public Wi-Fi networks.
As the threat landscape evolves, the reliance on public Wi-Fi for business continuity remains a significant vulnerability. Organizations must prioritize network segmentation and encrypted tunnels to protect sensitive corporate data from gateway-level attacks.
Source: Computerworld
Over to you: Are you currently using a full-tunnel VPN for all public Wi-Fi connections while traveling for work?
