The campaign has affected hospitality networks across several US cities, as well as locations in India and Saudi Arabia. Activity has been detected since at least June 2026, with visitors from financial services, law, healthcare, energy, retail and other industries connecting through manipulated gateways.
The operation differs from conventional phishing because attackers do not need to send fraudulent emails, persuade victims to open attachments or install malware on their devices. Instead, they gain administrative control of the network appliance that manages internet access for hotel guests and conference attendees.
Once inside the gateway, the attackers alter Domain Name System settings. DNS normally converts a website name into the numerical internet address required to reach it. A compromised gateway can provide a false answer, silently directing a traveller who enters a legitimate web address towards infrastructure controlled by the attacker.
Researchers identified Microsoft-themed domains designed to resemble Microsoft 365 and Outlook services. The infrastructure included m365-owa. com, owa-ms365. com, ms365-device. com and ms365-live. com. These domains were used to present imitation login or authorisation pages and were linked through shared registration details and overlapping activity.
The attackers appear to have focused heavily on Microsoft 365 accounts, which can provide access to corporate email, documents, calendars and other cloud resources. Some victims were shown prompts that resembled standard Microsoft sign-in or device-authorisation requests.
In a limited number of cases, the operation abused Microsoft’s device-code authentication process. This method allows a user to authorise a device by entering or approving a code. A deceptive page can persuade the victim to approve a session initiated by an attacker, allowing valid OAuth access tokens to be issued without directly capturing the person’s password.
Such tokens can be particularly valuable because they may grant access to accounts and applications while bypassing parts of the normal login process. Password changes alone may not remove an attacker if a malicious device or authorised session remains registered within the organisation’s identity environment.
The campaign also attempted to exploit Web Proxy Auto-Discovery, known as WPAD, in roughly one-third of the observed cases. WPAD allows devices to locate network proxy settings automatically. An attacker controlling the gateway can try to supply a malicious configuration file that routes application traffic through an unauthorised proxy.
That mechanism could extend surveillance beyond browser authentication to enterprise applications that rely on standard operating-system networking services. Researchers did not confirm that every WPAD attempt succeeded, suggesting it was used opportunistically rather than as the campaign’s main technique.
Initial access to the hospitality appliances has not been conclusively established. Exposed administrative services, internet-facing management consoles and weak or reused administrator passwords are considered possible entry points. Captive-portal gateways are attractive targets because a single successful intrusion can affect every guest who connects to the network.
The techniques resemble those associated with APT28, also tracked as Fancy Bear and Forest Blizzard, a cyber-espionage group linked to Russian military intelligence. Earlier operations attributed to the group compromised thousands of small-office and home-office routers and altered their DNS settings to intercept selected traffic.
Microsoft disclosed in April that Forest Blizzard and a subgroup tracked as Storm-2754 had affected more than 5,000 consumer devices and over 200 organisations through malicious DNS infrastructure. That campaign had operated since at least August 2025 and targeted sectors including government, telecommunications, technology and energy.
The hotel operation has not been firmly attributed to APT28. Its infrastructure does not match previously identified systems, and some behaviour differs from the earlier router campaign. Rather than selectively redirecting traffic connected to chosen domains, the hospitality attackers were observed sending broad DNS requests towards malicious infrastructure.
The strongest protection is an always-on corporate virtual private network configured to carry all internet and DNS traffic through trusted company systems. Split tunnelling, which permits some traffic to bypass the VPN, can leave authentication requests exposed to the local gateway.
Strict encrypted DNS can also prevent forged responses when plaintext fallback is disabled. Merely selecting a public resolver such as Google DNS may not be sufficient because unencrypted requests still pass through the compromised hotel appliance.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
