Hotel Wi-Fi has become a slick trap for business travelers, with hackers quietly steering victims from a normal-looking network to fake Microsoft 365 sign-in pages. The attack takes advantage of trust, speed, and distraction, turning a simple login moment into a high-stakes handoff of passwords, tokens, and company access.
Hackers are tampering with hotel Wi-Fi gateways to change DNS settings, which can reroute a browser away from the real Microsoft login page and toward a convincing clone. The connection can still look perfectly fine on the surface, and that is what makes it so dangerous. A traveler may see the hotel network name, open email, and never realize the page in front of them has been swapped out.
Once an attacker gets into a gateway, the device can be used to affect everyone connected to that network. Researchers say the weak spot may come from exposed admin tools, weak passwords, or outdated remote management systems. Older hardware with unpatched software can make the job even easier, especially in hotels, conference centers, and other places where updates sometimes lag behind real-world threats.
The fake login pages are built to look familiar enough to lower suspicion. Investigators found several domains dressed up with Microsoft-style language, making them feel routine to someone rushing through work on the road. That quick glance can be all the attacker needs to steal a Microsoft 365 username and password, then move into email, cloud files, and internal company tools.
It gets nastier with device code prompts. In those cases, a victim may see what looks like a normal sign-in approval step and think it is just part of the process. Behind the scenes, the attacker is already running the session, and once the user approves it, the hacker may get a valid token without ever needing to steal the password directly.
That trick can punch holes in multifactor authentication because the user becomes the one who completes the approval. The system sees a legitimate action, even though the request started on the wrong side of the screen. Any unexpected prompt asking for a device approval should be treated like a red flare, especially on a public or semi-public network.
Researchers also saw attempts to abuse WPAD, or Web Proxy Auto-Discovery, which Windows can use to find proxy settings on its own. In those cases, the attackers may respond with a malicious configuration file that sends traffic through a proxy they control. Even when the full outcome is unclear, the move shows that the goal may go beyond a simple stolen login.
One common assumption is that switching to a public DNS service will solve the problem, but that is not enough here. A compromised gateway can still forge the answer before the request reaches the public resolver, which means the device may be tricked anyway. Encrypted DNS is stronger, but only when it is locked down tightly enough to avoid falling back to plain-text traffic.
Travelers still have a few solid defenses, and the best ones are the boring ones that actually work. An always-on full-tunnel VPN can encrypt traffic before it ever hits the hotel network, which cuts down the chance of tampering. A phone hotspot can be even cleaner for quick work sessions, because it skips the hotel gateway altogether and keeps the path more direct.
Just as important, every Microsoft login should be checked with a skeptic’s eye. A domain that includes Microsoft-looking words is not proof of legitimacy, and a rushed click is exactly what the attacker wants. Using a saved bookmark or opening the official app keeps the journey simple and reduces the odds of landing on a fake page.
Unexpected device code requests deserve special caution, since they can hand over access while appearing harmless. If a prompt shows up without being started by the user, it should be questioned immediately and verified through a trusted IT contact. Keeping devices and browsers updated adds another layer, because old vulnerabilities and loose settings are exactly the kind of thing attackers love to chain together.
Strong security software can also help by flagging malicious pages, shady downloads, and other fallout from a phishing attempt. It will not fix a compromised gateway, but it can make the rest of the attack harder to pull off cleanly. For companies, the smarter move is to tighten Microsoft settings, review unusual login activity, and disable features like device code authentication or WPAD when they are not truly needed.
