Security researchers are warning travelers that hackers have found a way to hijack hotel Wi-Fi networks and quietly redirect guests to fraudulent Microsoft 365 login pages, according to a report published by CyberInsider. The technique, known as DNS poisoning, requires no malware on a victim’s laptop or phone, making it especially difficult for business travelers to detect before their corporate credentials are already gone.
The attack works by corrupting the Domain Name System records that a hotel’s network uses to translate web addresses into server locations. Once a hotel’s router or DNS server is compromised, attackers can silently reroute anyone who tries to reach legitimate Microsoft login pages toward a lookalike site designed to harvest credentials in real time.
How the Attack Works
Unlike traditional phishing, which relies on tricking a user into clicking a suspicious link in an email, DNS poisoning intercepts traffic at the network level. A guest connecting to hotel Wi-Fi and opening a browser to check email or a shared document may be sent to a spoofed Microsoft 365 portal that looks identical to the real thing, without ever seeing an unusual link or sender.
- The victim enters a username and password on the fake page, which is captured by the attacker.
- Some versions of the attack use an adversary-in-the-middle proxy that also intercepts one-time passcodes or session tokens, allowing attackers to bypass multi-factor authentication protections.
- Because the redirection happens at the network’s DNS layer, the browser’s address bar may still appear to show a familiar domain, and security warnings that would normally flag a mismatched certificate can be suppressed on poorly configured networks.
Researchers note that hotel networks are attractive targets because they are typically shared by large numbers of transient guests, often lack dedicated IT security staff, and are frequently built on outdated router firmware that has not been patched in years. Business travelers logging into corporate Microsoft 365 accounts, which hold access to email, cloud storage, and internal collaboration tools, represent a particularly valuable target for attackers seeking a foothold inside corporate networks.
Why Microsoft 365 Accounts Are a Prime Target
Microsoft 365 has become the backbone of corporate communication and file storage for millions of businesses worldwide, making a single compromised login a potential gateway to sensitive company data. Once inside an account, attackers can read internal emails, impersonate employees to launch further phishing campaigns against coworkers or clients, and search cloud storage for financial records or credentials to other systems.
Security experts stress that credential theft through network-level attacks like DNS poisoning is difficult for individual users to spot, since the deception happens before any suspicious email or link ever reaches the victim.
This is not the first time public Wi-Fi has been used as a launchpad for credential theft, but the specific targeting of Microsoft 365 accounts through hotel networks marks an escalation in how attackers are adapting classic techniques to modern cloud-based work environments. The tactic mirrors a broader trend of state and criminal hacking groups exploiting overlooked infrastructure. Compromised hardware supply chains have similarly drawn scrutiny after reports that China supplies roughly 90 percent of the electronics found in Russian military drones, underscoring how deeply intertwined global hardware and software supply chains have become with cybersecurity risk.
How Travelers Can Protect Themselves
Cybersecurity professionals recommend several precautions for anyone connecting to hotel or other public Wi-Fi networks:
- Use a reputable virtual private network (VPN) to encrypt traffic before it reaches the hotel’s router, which can prevent DNS poisoning from redirecting web requests.
- Enable phishing-resistant multi-factor authentication, such as hardware security keys, rather than relying solely on one-time passcodes sent by text or app, since some versions of this attack can intercept those codes.
- Verify that any login page uses a valid HTTPS certificate matching the exact expected domain before entering credentials.
- Avoid logging into sensitive accounts on unfamiliar networks when possible, and use a mobile data connection instead for anything involving corporate email or financial accounts.
- Report unusual account activity to an employer’s IT security team immediately, since early detection can limit the damage from a compromised session.
Hotel operators, meanwhile, are being urged to audit their network infrastructure regularly, apply firmware updates promptly, and segment guest Wi-Fi from any administrative systems that control DNS settings. Security researchers say the hospitality industry has historically underinvested in network security compared to sectors handling similarly sensitive data, leaving a gap that attackers have increasingly moved to exploit.
As remote and hybrid work keeps more employees logging into corporate systems from hotels, airports, and coffee shops, researchers say attacks that target the network itself, rather than the end user’s device, are likely to become more common. For now, experts say the simplest defense remains vigilance: treating any unexpected login prompt on public Wi-Fi as a potential red flag rather than a routine inconvenience.
