A sophisticated cybersecurity threat is targeting business travelers by compromising the Wi-Fi infrastructure at hotels and convention centers across the United States. According to Fox News — Tech, researchers at ReliaQuest have been tracking this campaign since June, noting that the attackers are hijacking network gateways to intercept and reroute user traffic. By gaining administrative access to these local appliances, hackers can manipulate Domain Name System (DNS) settings, effectively acting as an invisible middleman that steers victims toward fraudulent, high-fidelity replicas of Microsoft 365 login screens.

This method is particularly dangerous because the connection appears entirely legitimate to the end-user. Because the hotel's network hardware itself is compromised, devices remain connected to the venue's Wi-Fi, and other websites may load normally, masking the redirection. The attack surface appears broad, with evidence of compromised hardware affecting organizations across the financial, legal, health care, energy, and retail sectors. Security experts suggest that these breaches are likely facilitated by weak administrative passwords, unpatched legacy firmware, or poorly secured remote management interfaces on the Wi-Fi gateways themselves.

Once an employee inadvertently provides their credentials on the counterfeit page, the attackers can gain unauthorized access to corporate accounts. Because the breach happens at the network gateway level, a single compromised device can facilitate a mass-harvesting operation during large professional gatherings. Organizations are encouraged to audit their remote access protocols and emphasize the use of hardware-based security keys or robust multi-factor authentication, as these methods can often thwart credential harvesting even if a user is successfully tricked into entering their password on a fraudulent site.