Affected Systems
Wi-Fi gateways at hotels and conference centers in multiple U.S. cities, India, and Saudi Arabia. Targets traveling employees from financial services, professional services, legal, healthcare, energy, and retail sectors accessing Microsoft 365. Campaign active since at least June 2026.
Exploitation Status
Active exploitation confirmed since June 2026. ReliaQuest observed compromised Wi-Fi gateways redirecting traffic to attacker-controlled domains. Device code authentication flow abuse bypasses MFA. Campaign attributed with similarities to APT28 (Fancy Bear) tactics.
Business Impact
Attackers gain access to Microsoft 365 accounts including email, documents, and business communications. Device code flow abuse issues legitimate OAuth tokens to attackers, bypassing MFA without credential theft. Public DNS (e.g., 8.8.8.8) does not prevent attack as gateway forges DNS requests before external resolution. WPAD abuse attempts observed in one-third of cases to route traffic through attacker proxies. Impacts organizations with traveling employees using public Wi-Fi at business venues.
Urgency
🟠Within 24 hours
Recommended Actions
- Deploy always-on full-tunnel VPN for all traveling employees accessing corporate resources on untrusted networks
- Enable encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) in strict mode on corporate endpoints to prevent DNS manipulation
- Disable Device Code authentication flow in Microsoft Entra ID unless specifically required for business operations
- Disable Web Proxy Auto-Discovery (WPAD) protocol on Windows endpoints via Group Policy or registry settings
- Monitor Microsoft 365 sign-in logs for suspicious OAuth token grants, device code flows, and logins from unexpected geolocations or travel patterns