Hotel Wi-Fi DNS Hijacking Warning: Why Travellers Should Use a Full-Tunnel VPN
BleepingComputer reports that attackers are compromising hotel and conference Wi-Fi gateways to redirect Microsoft 365 users to fake login pages.
Quick takeaways
- Attackers are reportedly changing DNS settings on compromised hotel and conference Wi-Fi gateways to send Microsoft 365 users to fake login pages.
- The campaign is especially relevant to travelling employees because the network itself can become the phishing path.
- A full-tunnel VPN can reduce exposure to local DNS tampering, but it does not remove the need to verify login prompts, disable risky authentication flows and monitor accounts.
What happened?
BleepingComputer reported on ReliaQuest research into a campaign targeting hotel and conference-centre Wi-Fi gateways. According to the report, attackers compromise network gateways and change DNS settings so users trying to reach Microsoft 365 services can be redirected to fake Microsoft login pages.
The activity has reportedly been observed across multiple sectors, including finance, professional services, legal, healthcare, energy and retail. BleepingComputer says ReliaQuest also observed attempted abuse of Windows Web Proxy Auto-Discovery in some cases and device-code authentication flows that can trick users into authorising an attacker-controlled session.
Why it matters
Hotel Wi-Fi is usually treated as a convenience risk: slow speeds, captive portals and unknown network operators. This story is more serious because the trusted-looking login destination can be altered before the user notices anything is wrong. If DNS is tampered with at the gateway, typing a familiar Microsoft address may still lead to a convincing phishing page.
For remote workers and business travellers, one stolen Microsoft 365 session can expose email, calendars, cloud files, internal chats and password-reset routes. The risk is not limited to people who click obviously suspicious links; the network path itself can become part of the attack.
What you can do now
Before logging into work accounts on hotel or conference Wi-Fi, connect an always-on, full-tunnel VPN from a provider or employer you trust. If your organisation supports encrypted DNS in a strict mode, use it. Avoid approving unexpected Microsoft device-code prompts, and report any sign-in page that appears after unusual redirects, certificate warnings or repeated login loops.
Administrators should review Microsoft Entra sign-in logs for travel-location anomalies, unexpected OAuth token issuance and device-code authentication. Disable device-code flow where it is not needed, disable WPAD where practical, and remind staff that public Wi-Fi attacks can begin before a phishing email ever arrives.
Where a VPN helps — and where it does not
A full-tunnel VPN helps because it routes traffic, including DNS in many configurations, through an encrypted tunnel rather than trusting the hotel gateway's normal DNS path. That can reduce the chance that a compromised local gateway silently points you at fake services.
A VPN does not make every login prompt genuine. If a user approves a malicious device-code prompt or enters credentials into a fake page outside the protected path, account controls still matter. MFA, phishing-resistant authentication, conditional access, endpoint hardening and log review remain essential.
VPN Rocks view
This is one of the clearest real-world examples of where a VPN is relevant without hype. The risk starts at an untrusted network edge, and a properly configured VPN can materially reduce exposure.
The caveat is just as important: a VPN protects the route, not your judgement or your identity provider. Treat public Wi-Fi protection as a bundle: full-tunnel VPN, careful login verification, updated devices and strong account monitoring.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.