Hotel Wi-Fi DNS Hijacking: Defending Against Microsoft 365 Credential Harvesting

Business travelers are facing a renewed and sophisticated threat at the network edge. Recent intelligence confirms that attackers are actively targeting the Wi-Fi infrastructure of hotels and conference centers to execute large-scale DNS hijacking campaigns. By altering the DNS settings on compromised on-premise gateways, threat actors are redirecting traffic intended for legitimate Microsoft 365 services to credential-harvesting proxies.

For security practitioners, this represents a critical failure of the "last mile" defense. Unlike traditional phishing attacks that rely on social engineering via email, this campaign compromises the network layer itself. Users attempting to access login.microsoftonline.com are transparently served a near-perfect replica of the Microsoft 365 login portal. This method bypasses many email security filters and exploits the implicit trust users place in the venue's network connection. The primary objective is to harvest valid credentials and session tokens for enterprise accounts, facilitating initial access vectors for ransomware or espionage operations.

Technical Analysis

Attack Vector: The attack chain begins with the compromise of the venue's Wi-Fi hardware (routers, access points, or gateways). While the specific vulnerability leading to the initial router compromise may vary, the critical phase for defenders is the manipulation of the DHCP configuration. Attackers modify the DNS server settings provided to clients via DHCP, pointing them to a resolver under the attacker's control.

Mechanism of Action:

1. DHCP Misconfiguration: The victim's device connects to the malicious Wi-Fi SSID and receives a DHCP offer containing a rogue DNS server IP.
2. DNS Redirection: When the victim's browser attempts to resolve login.microsoftonline.com or related Microsoft 365 endpoints, the rogue DNS server responds with the IP address of the attacker's phishing server.
3. Credential Harvesting: The victim is presented with a spoofed login page. Upon entry, credentials are transmitted to the attacker's infrastructure, often validated in real-time against Microsoft's Active Directory to determine legitimacy, and the user is then redirected to the legitimate site to minimize suspicion.

Affected Platforms:

• Client-Side: Windows, macOS, iOS, and Android devices are all equally susceptible if they accept the rogue DHCP settings.
• Target Services: Microsoft 365 (Exchange Online, SharePoint Online, Teams).

Exploitation Status: Active exploitation has been confirmed in hospitality sectors globally. No specific CVE is required for the DNS redirection mechanism itself, as it leverages standard protocol manipulation; however, the initial router compromise may involve unpatched vulnerabilities or weak administrative credentials.

Detection & Response

This is a Technical Threat. Defenders must focus on network anomalies and endpoint behavior indicative of DNS manipulation.

SIGMA Rules

---
title: Suspicious DNS Resolution for Microsoft 365 Services
id: 8a4b2c91-1d3e-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects DNS queries for Microsoft 365 login services resolving to non-standard or private IP addresses, indicative of DNS hijacking or local network redirection.
references:
  - https://attack.mitre.org/techniques/T1570/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1059.001
  - attack.t1570
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'login.microsoftonline.com'
      - 'outlook.office.com'
      - 'www.office.com'
  filter_main_microsoft:
    Answers|contains:
      - '.microsoft.com'
      - '.msedge.net'
      - '.azure.net'
      - '.akadns.net'
  filter_suspicious_ips:
    Answers|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_main_microsoft or (selection and filter_suspicious_ips)
falsepositives:
  - Internal proxies or inspection devices configured to intercept TLS
level: high
---
title: Potential Credential Harvesting via PowerShell Web Request
id: 9c5d3e02-2e4f-5a6b-0c7d-1e8f0a2b3c4d
status: experimental
description: Detects PowerShell processes making network connections to non-Microsoft IPs that may be associated with credential harvesting proxies following a DNS redirection.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    DestinationPort:
      - 80
      - 443
    Initiated: 'true'
  filter_legit_cdns:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.windowsupdate.com'
      - '.azureedge.net'
  condition: selection and not filter_legit_cdns
falsepositives:
  - Administrators running scripts against non-Microsoft APIs
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for DNS resolutions to Microsoft services resolving to suspicious IP ranges
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl contains "microsoft" 
| where RemoteUrl has_any ("login", "outlook", "office")
| where isnotempty(RemoteIP)
// Filter out known Microsoft IP ranges (simplified for query performance)
| where not(RemoteIP has_any ("20.", "40.", "52.", "104.") or RemoteUrl contains "microsoft")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

Velociraptor VQL

-- Hunt for DNS cache entries indicating redirection to private/local IPs
SELECT Fqdn, Address, Type, TimeStamp
FROM dns_cache()
WHERE Fqdn =~ 'microsoft' 
   AND (Address =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)' 
        OR Address =~ '^(127\.|0\.)')

Remediation Script

# Remediation: Flush DNS Cache and Verify Interface Settings
# Run as Administrator

Write-Host "[+] Clearing DNS Client Cache..."
Clear-DnsClientCache

Write-Host "[+] Flushing DNS Resolver Cache..."
Clear-DnsClientServerAddress -InterfaceAlias "*" -Confirm:$false

# Force DHCP Renew to obtain correct settings (if on DHCP)
Write-Host "[+] Renewing DHCP Lease..."
Get-NetAdapter | Where-Object Status -eq 'Up' | ForEach-Object {
    $iface = $_.Name
    Write-Host "Renewing IP for $iface..."
    $null = ipconfig /renew $iface
}

Write-Host "[+] Current DNS Servers per Interface:"
Get-DnsClientServerAddress -AddressFamily IPv4 | Select-Object InterfaceAlias, ServerAddresses

Write-Host "[+] Verification Complete. Please check that DNS Servers match expected infrastructure."

Remediation

Immediate containment and recovery are required upon detection of this activity within your environment:

1. User Education & Awareness: Immediately notify traveling employees of this specific campaign. Instruct users to verify the URL (ensure HTTPS and the valid microsoft.com domain) and to look for certificate warnings.
2. Enforce VPN Usage: Mandate the use of Enterprise VPN for all corporate data access when connected to public or non-corporate Wi-Fi. VPN tunneling encrypts DNS traffic, preventing local network hijacking from redirecting internal queries (if split-tunneling is managed correctly) or protecting the integrity of the data stream.
3. Configure DNS-over-HTTPS (DoH): Where possible, enable DoH on corporate endpoints. This forces DNS queries over an encrypted channel to a trusted resolver, neutralizing the attacker's ability to spoof DNS responses on the local network.
4. Reset Credentials: If a device was connected to a compromised network and login attempts were observed, consider the credentials compromised. Force a password reset and revoke any active session tokens.
5. Conditional Access Policies: Strengthen Conditional Access policies to detect "Impossible Travel" scenarios or logins from unfamiliar ASN/IP ranges often associated with proxy services.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub