LEGALAUDIT

Scam Radar

How can you recognize Hackers hijack hotel Wi Fi to steal Microsoft 365 accounts via fake login pages?

Published

Listen to the episode

TLDR

Travelers connecting to hotel or conference Wi Fi networks are being silently redirected to fake Microsoft 365 login pages. Attackers compromise the Wi Fi gateway's DNS settings so that the legitimate Microsoft URL resolves to a phishing...

How it works

Travelers connecting to hotel or conference Wi Fi networks are being silently redirected to fake Microsoft 365 login pages. Attackers compromise the Wi Fi gateway's DNS settings so that the legitimate Microsoft URL resolves to a phishing...

Red flags

  • Microsoft 365 login page looks slightly off, has an unfamiliar domain, or shows up after connecting to hotel Wi Fi. An unexpected "device code" approval prompt appears on screen asking you to confirm a sign in you did not start. Your browser or apps behave oddly, show proxy errors, or Windows tries to auto configure a network proxy (WPAD)

What to do

  1. 1Always use a trusted, full tunnel VPN with encrypted DNS (DoH/DoT) before joining public Wi Fi. Never approve Microsoft device code prompts you did not initiate
  2. 2cancel and change your password. Disable WPAD in Windows and turn off the Device Code authentication flow in Microsoft Entra ID when not required

Source

bleepingcomputer

Source reviewed by Mythos Forensic Team

https://www.bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accounts/

FAQ

Is Hackers hijack hotel Wi Fi to steal Microsoft 365 accounts via fake login pages a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Microsoft 365 login page looks slightly off, has an unfamiliar domain, or shows up after connecting to hotel Wi Fi. An unexpected "device code" approval prompt appears on screen asking you to confirm a sign in you did not start. Your browser or apps behave oddly, show proxy errors, or Windows tries to auto configure a network proxy (WPAD)

What should I do first?

Always use a trusted, full tunnel VPN with encrypted DNS (DoH/DoT) before joining public Wi Fi. Never approve Microsoft device code prompts you did not initiate; cancel and change your password. Disable WPAD in Windows and turn off the Device Code authentication flow in Microsoft Entra ID when not required

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.