Hackers Hijack Hotel Wi-Fi Gateways to Steal Microsoft 365 Accounts Without Phishing

Threat actors are compromising hotel and conference-center Wi‑Fi gateways to steal Microsoft 365 accounts from traveling employees without sending phishing emails or infecting endpoints. The campaign uses DNS poisoning and, in some cases, Microsoft device-code flow abuse to redirect users to attacker-controlled infrastructure. The activity has reportedly been active since at least June 2026. It affects shared Wi‑Fi environments in multiple U.S. cities, India, and Saudi…

Diamond Model