Compromised Hotel Gateways, Fake Microsoft Domains, and the APT28-Adjacent Campaign That Bypasses MFA Without a Phishing Click

An employee connects to hotel Wi-Fi, receives a familiar Microsoft 365 sign-in prompt, and authenticates. No phishing email. No malicious link. No suspicious attachment. Yet an attacker walks away with a valid, MFA-satisfied session token.

 Join hosts Alexandra Moore and John Dilgen as they break down:

• How compromised hotel and conference-center Wi-Fi gateways silently redirect Microsoft authentication traffic
• Why hardcoded DNS, opportunistic encrypted DNS, and MFA may not stop the attack
• How device-code phishing and WPAD abuse expand the campaign’s reach
• Practical defenses—including always-on, full-tunnel VPN, strict-mode encrypted DNS, and Conditional Access controls

 Two questions your organization should be asking right now:

• Does your always-on VPN tunnel all DNS and authentication traffic, or do split-tunneling exceptions leave traveling employees exposed?
• Who is permitted to authenticate through the device-code flow, and does each exception have a legitimate business justification?

John Dilgen: Cyber Threat Intelligence Analyst at ReliaQuest, where he specializes in researching cyber threats impacting ReliaQuest customers. With a strong technical background, he previously served as an Incident Response Analyst and Trainer at ReliaQuest.

Alexandra Moore: Manager of Threat Intelligence at ReliaQuest, where she leads intelligence analysis and customer dissemination to help organizations understand and respond to emerging cyber threats. Prior to this, she established and scaled monitoring across Russian-language cybercriminal platforms at Digital Shadows, building collection and analytical coverage to support digital risk protection capabilities.