Hotel Wi-Fi is quietly stealing your staff's Microsoft 365 logins
Picture a member of your team away for a couple of nights. A trade show, a client visit, a conference. They check into the hotel, connect the laptop to the guest Wi-Fi, and open Microsoft 365 to catch up on email. The login page looks exactly right. They sign in. Nothing feels wrong, because from their side nothing is wrong. There was no dodgy link to spot, no attachment to refuse, nothing to click. The venue's Wi-Fi router had been tampered with before they arrived, and their username and password have just been handed to someone else.
That is the shape of a live campaign that security firm ReliaQuest documented on 23 July. It matters to any business whose people work from hotels, conference centres, or other shared venues, which is most of them.
What is actually happening
The attackers are not going after your staff directly. They are going after the Wi-Fi kit at the venue. ReliaQuest found the routers that provide guest Wi-Fi had been broken into, in most cases through management interfaces left exposed to the internet, or protected with weak or reused admin passwords.
Once inside the router, the attacker changes one setting: the address book the network uses to look up websites, known as DNS. Think of DNS as the network's contacts list, turning a name like "login.microsoftonline.com" into the actual address of the server. Poison that list, and the router quietly sends your colleague to a fake Microsoft 365 login page instead of the real one, while everything on screen still says Microsoft. They type in their password, the fake page passes it straight to the attacker, and often forwards them on to the genuine site so nothing looks amiss.
The important detail is what is missing. There is no phishing email, no malicious link, no file to open. The user did nothing wrong. Staff training that teaches people to spot a bad link has nothing to catch here, because there is no link to spot.
ReliaQuest found compromised gateways in the United States, India, Saudi Arabia, and elsewhere, hitting travelling employees across financial services, professional services, legal, healthcare, energy, and retail. The tradecraft resembles earlier operations linked to APT28, a group tied to Russian military intelligence, though the target here is ordinary corporate logins wherever people connect. Hotels are the current hunting ground, but the researchers were blunt that any captive-portal network, airports, coworking spaces, conference venues, and universities among them, has the same weakness.
Why this reaches a small business
You do not run the hotel's router. You cannot patch it, and you will never know it was compromised. That is exactly why this belongs on your list rather than the venue's.
A single harvested Microsoft 365 login is rarely the end of it. That one account is the doorway to your colleague's email, the shared documents they can reach, and often the ability to send convincing messages to your customers and suppliers from a real, trusted address. For a firm with 30 or 40 people, one set of travelling credentials can be enough to open the lot.
What to do this quarter
Two changes shut this attack down, and neither costs anything.
Make passwords not enough. If a stolen password alone can get into your Microsoft 365, that is the gap. Move your accounts to sign-in that a captured password cannot satisfy on its own. Passkeys are the strongest option here: they are the "hold your phone to the prompt" or fingerprint sign-in that ties the login to both your device and the genuine Microsoft site, so a fake page gets nothing usable even if it grabs the password. Start with the accounts that would hurt most, your administrators and finance, then work outward. Our filing on why NCSC says passkeys first, passwords second covers the rollout.
Route staff around the untrusted network. ReliaQuest's own top recommendation is an always-on VPN set to full-tunnel, so that every lookup and every connection from a work laptop goes through your own trusted infrastructure rather than the venue's poisoned router. A VPN, a virtual private network, is an encrypted tunnel back to a network you control. With it on, the hotel router never gets to decide where your colleague's login page comes from. If you use an outside IT provider, this is the question to put to them: do our laptops force all traffic through a VPN on untrusted Wi-Fi, and if not, why not.
Two smaller habits back these up. Teach people to glance at the address bar and the padlock before typing a password on public Wi-Fi, and to treat any login page that appears after joining a hotel or conference network with suspicion. And where you can, turn on conditional access rules in Microsoft 365 so a sign-in from an unusual place has to clear an extra hurdle.
How Steelwise can help
Working out whether a stolen password alone can get into your systems, and closing that gap without turning travel into a chore for your team, is the kind of review we do. Get in touch.
Further reading
- NCSC: Using public Wi-Fi safely
- NCSC: Multi-factor authentication for online services
- Microsoft: Conditional Access overview