Hackers Hijack Hotel Wi‑Fi Gateways to Harvest Microsoft 365 Credentials
What Happened — Attackers compromised public Wi‑Fi gateways at hotels and conference centers, altered DNS responses, and redirected users to counterfeit Microsoft 365 login pages, harvesting corporate credentials without any phishing email or attachment.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a real‑world failure of access‑control policies for network‑infrastructure accounts (admin passwords, SSH, SNMP).
- Highlights the need for continuous monitoring of third‑party network assets and evidence of DNS‑traffic integrity as part of SOC 2 CC6 (System and Communications Protection).
- Aligns directly with Verisq’s SOC2 Access Controls capability, which provides automated evidence of credential‑management hygiene and network‑gateway hardening.
Who Is Affected – Finance, legal, healthcare, energy, retail, and any organization with traveling employees who rely on public Wi‑Fi.
Recommended Actions – Review and rotate admin credentials on all internet‑facing network devices, enforce MFA for privileged accounts, enable DNSSEC or encrypted DNS in strict mode, and incorporate Wi‑Fi gateway health checks into your continuous‑compliance monitoring. Source: Security Affairs
Technical Notes – Attackers leveraged weak/reused admin passwords on exposed SSH, SNMP, or web consoles to gain control of the gateway, then performed DNS poisoning to serve phishing pages mimicking login.microsoftonline.com. No specific CVE is cited; the vector is credential‑based compromise of management interfaces. Source: same