Security · 1h ago
DNS Poisoning on Hotel Wi-Fi Steals Microsoft 365 Sessions
Attackers compromise hotel Wi-Fi gateways to forge DNS responses, redirecting business travelers to fake Microsoft login pages. The attack uses device-code authentication to steal MFA-protected OAuth tokens, bypassing password and MFA. No phishing emails are involved; victims are tricked during Wi-Fi connection.
Meridian48 take
This attack chain is particularly insidious because it exploits trust in captive portals and bypasses standard MFA, making it a serious threat for remote workers.
Read the full reporting
Public Wi‑Fi DNS Poisoning: Hijacking Microsoft 365 Sessions of Business Travelers →
DEV Community
dns-poisoningmicrosoft-365