Compromised Public Wi‑Fi Gateways Steal Microsoft 365 Logins from Travelers
ReliaQuest uncovered a campaign that hijacks captive‑portal routers in hotels, airports and conference centers to DNS‑poison visitors and siphon Microsoft 365 credentials from traveling employees. The attackers reuse APT28‑style tradecraft but target any industry, exposing a new attack surface for organizations that run public Wi‑Fi.