Security researchers have uncovered an active attack campaign targeting hotel WiFi infrastructure. Rather than tricking users into clicking phishing emails, attackers are compromising hotel network equipment itself to steal Microsoft 365 credentials from business travelers.
For MSPs and cybersecurity providers, this is more than another headline. It is a reminder that customers with traveling employees face a growing attack surface that traditional security awareness training alone cannot address.
A New Way to Steal Microsoft 365 Credentials
Security researchers recently uncovered a campaign in which attackers compromised the captive WiFi gateways used by hotels and conference centers. Rather than attacking individual users directly, the attackers compromised the equipment responsible for connecting guests to the internet.
Once the gateway was under their control, they manipulated DNS requests and redirected users attempting to sign in to Microsoft 365 toward convincing fake authentication pages. These pages were designed to capture usernames, passwords, and even multi-factor authentication sessions.
What makes this attack particularly dangerous is that users often do not indicate that anything is wrong.
They are not clicking suspicious links in an email.
They are not downloading malicious software.
They are simply connecting to the hotel’s wireless network and logging in to Microsoft 365 as they normally would.
From the employee’s perspective, everything appears legitimate.
Why This Matters
Business travelers routinely access sensitive company resources while away from the office. Email, Teams, SharePoint, OneDrive, CRM systems, financial applications, and internal business applications are all commonly accessed over hotel and public WiFi.
If an attacker successfully steals Microsoft 365 credentials, the consequences can extend well beyond email.
A compromised Microsoft identity can provide access to corporate documents, customer information, collaboration platforms, and cloud applications. It can also become the starting point for business email compromise attacks, data theft, ransomware deployment, or additional phishing campaigns targeting coworkers.
For many organizations, Microsoft 365 has become the central hub for business operations. Protecting employee identities has never been more important.
Why VPN Protection Still Matters
In recent years, some vendors have suggested that VPNs are becoming less relevant as organizations adopt cloud services and Zero Trust security models.
The reality is much different.
When an employee connects to an encrypted VPN immediately after joining an untrusted network, their internet traffic is encrypted before it leaves the device. Instead of communicating directly across the hotel’s network, business traffic travels through an encrypted tunnel to trusted infrastructure.
This significantly reduces opportunities for attackers operating on compromised public WiFi to inspect or manipulate sensitive communications.
No security solution eliminates every threat, but encrypting traffic over untrusted networks remains one of the most effective ways to protect employees while traveling.
Zero Trust Adds Another Layer of Protection
Secure connectivity is only part of the solution.
Modern organizations also need to control exactly what users can access after they authenticate.
This is where Zero Trust Network Access, or ZTNA, provides additional protection.
Unlike traditional network access, ZTNA grants employees access only to the specific applications and resources they are authorized to use. Users never receive broad access to the corporate network simply because they successfully logged in.
Even if an attacker were somehow able to compromise a user’s credentials, their ability to move throughout the organization’s environment is significantly reduced because they are limited to only the resources explicitly allowed by policy.
Zero Trust assumes that every connection should be verified rather than automatically trusted.
Protecting Employees Wherever They Work
Private Communications developed Remote WorkForce to address exactly these types of challenges facing today’s mobile workforce.
Organizations can begin by deploying Remote WorkForce VPN to provide employees with encrypted connections whenever they work from hotels, airports, conference centers, coffee shops, or other public locations.
As security requirements evolve, organizations can transition to Remote WorkForce ZTNA using the same platform through our Glide Path to ZTNA approach.
Rather than replacing one remote access solution with another, businesses can migrate at their own pace while maintaining the same management platform, security policies, and user experience.
This approach allows organizations to strengthen security without disrupting employees or requiring a complete redesign of their remote access environment.
Why MSPs Should Be Talking to Clients Today
No single technology can prevent every cyberattack.
Organizations should continue encouraging employees to verify website addresses before signing in, enable strong multi-factor authentication, keep devices fully updated, and remain cautious when using unfamiliar public networks.
At the same time, organizations should recognize that attackers are increasingly targeting the networks employees trust rather than the employees themselves.
Today’s threat may be a compromised hotel Wi-Fi gateway.
Tomorrow it could be another trusted service.
Combining encrypted remote access, Zero Trust security, strong identity protection, and user awareness provides organizations with multiple layers of defense against an evolving threat landscape.
As business travel continues to increase, protecting employees wherever they connect is no longer just a convenience. It is an essential part of modern cybersecurity.