Hotel Wi-Fi Just Got Weaponized: How Hackers Hijack DNS to Steal Microsoft 365 Logins (and Why a VPN Still Helps)
If you have ever closed a laptop in a hotel lobby and trusted that the Wi-Fi would behave like the Wi-Fi at your office, the last week of July 2026 is a reason to rethink that habit. Security researchers at BleepingComputer and HackRead have independently documented a wave of attacks in which criminals silently rewrite the DNS settings on hospitality Wi-Fi gateways and then sit back as guests type their real Microsoft 365 passwords into convincing replicas of the legitimate login page. The same pattern is being seen at conference venues and co-working spaces. The good news is that the underlying technique is not new, and the defenses are not complicated. The bad news is that most travelers are not using any of them.
What is actually happening
In the attacks reported this month, the victim is not the guest's laptop. The victim is the gateway. Hotel and conference Wi-Fi almost always runs on a managed router that offers a captive portal for authentication and that, behind the scenes, controls DNS for every connected device. Once an attacker gains administrative access to that router, either through a default or stolen credential, an unpatched firmware vulnerability, or social engineering of the on-site IT contractor, they can flip the DNS records that the gateway hands out. From that moment on, anyone in the lobby who types login.microsoftonline.com into a browser is silently redirected to an attacker-controlled server that looks exactly like Microsoft's real portal. The TLS certificate can even match, because the attacker has learned to issue certificates for the original hostname through automated validation services.
The phishing page collects the email address and password, forwards them to the real Microsoft endpoint so that the login succeeds and no visible error appears, and then stores the session cookie. In several cases, the attacker logs in within seconds and uses the legitimate session to enable inbox forwarding rules, create new OAuth app consents, and pivot into SharePoint and OneDrive before the user has even closed the browser tab. Two-factor authentication on the user's account does slow this down, but it does not stop it, because the attacker is now passing through the real Microsoft servers with a valid session.
Why hotel Wi-Fi is uniquely fragile
Public Wi-Fi in general has always been risky. Hotel and conference Wi-Fi is a special case for three reasons. First, the equipment is rarely patched on a fast cadence. Gateway firmware updates are pushed by vendors on a quarterly or longer cycle, while hospitality IT teams often have no formal asset inventory and no monitoring for unexpected configuration changes. Second, the networks are shared by hundreds of strangers in a short window, which gives an attacker a high density of targets and a fast feedback loop. Third, the captive portal means that DNS typically flows through a single, vendor-managed resolver rather than the encrypted resolvers that modern operating systems prefer. When that resolver is compromised, every client on the network is compromised at the same time.
Microsoft's own guidance for traveling executives has long pointed at this risk. The current wave is notable because it appears to target Microsoft 365 specifically rather than generic banking or consumer credentials. That focus suggests the attackers are after corporate email, files, and the OAuth app permissions that grant persistent access to SaaS tenants long after the user has checked out.
Why a VPN is still the single best defense
A trustworthy VPN does three things at once when you connect to hotel Wi-Fi. It moves your DNS lookups off the gateway's resolver and onto a resolver that you control or that your VPN provider runs, which defeats the most direct version of this attack. It encrypts every packet between your device and the VPN server, so the gateway can no longer see the destination hostnames you are about to contact. And, if it includes a kill switch and DNS leak protection, it prevents the operating system from silently falling back to the network's default resolver when the VPN tunnel drops for a second. None of those defenses are exotic; they have been standard features in reputable consumer VPNs for years. What is new is that they are no longer optional for anyone who logs into a Microsoft 365 tenant from a hotel room.
It is worth being precise about what a VPN does not do. It does not protect you from logging into a phishing page through the VPN tunnel itself. If the attacker is performing a man-in-the-middle at a higher layer, or if they have compromised a website you trust, the VPN will pass the traffic along faithfully. It also does not protect a device that is already infected with malware before you connected, or a device that has been configured to trust a malicious root certificate installed by previous malware. For those layers, you need endpoint protection, hardware security keys, and a healthy skepticism of any certificate warning that appears in a browser.
Ten steps to take before you connect to any hotel network
Connect to your VPN before you open a browser, sign in to Wi-Fi, or accept the captive portal terms. The VPN should be active while you type credentials into the portal itself.
Confirm that the VPN's kill switch and DNS leak protection are turned on. Test them on a different network before you travel so you know what a tunnel failure looks like on your device.
Use a hardware security key for Microsoft 365 rather than SMS or app-based codes. A FIDO2 key cannot be phished in real time because the browser binds the challenge to the real domain.
Disable auto-connect to open Wi-Fi networks on your laptop and phone. Most operating systems will silently join a network named after a nearby hotel or airport and expose traffic to it before you even open a browser.
Use your phone's cellular hotspot as a fallback whenever the work is sensitive. A modern phone on a mobile network is dramatically less exposed than the gateway in the lobby.
Treat any unexpected certificate warning as a hard stop. A legitimate Microsoft 365 login page on a real Microsoft domain never produces a certificate error in a modern browser.
Open a private browsing window for the captive portal so that portal cookies and tracking parameters do not bleed into your work sessions.
Review inbox forwarding rules and OAuth app consents on your Microsoft 365 account the morning after you have traveled. Attackers who harvest a session often act within hours and try to persist by adding rules and apps you will not notice.
Keep your laptop and phone fully patched and reboot them before you leave home. A clean session with an up-to-date browser is a smaller target than one that has been running since your last reboot a month ago.
If you run a corporate Microsoft 365 tenant, enable Conditional Access policies that require a compliant device or an approved network for high-risk sign-ins. Combined with security keys, this turns a stolen password into a useless artifact.
The wider pattern, and what it means for 2026
Hotel and conference DNS hijacks are not a new category. What is new in 2026 is the focus on Microsoft 365 and the speed at which attackers turn a single credential into persistent access across a SaaS tenant. The same playbook is being applied to other federated identity providers, to password managers, and to VPN concentrators themselves. Public Wi-Fi is no longer a curiosity for security teams. It is a confirmed initial-access vector for the kind of business email compromise that dominates insurance claims and breach disclosures this year. Travelers who treat every hotel network as hostile, and who layer a reputable VPN with hardware-backed multi-factor authentication, are simply not part of the easiest victim pool. Everyone else is, and the campaigns currently running are designed to find them.
If you take one thing from this article, take this: connect your VPN first, trust the captive portal last, and never let a hotel network see your Microsoft 365 password without a hardware key on the other end of the login.
