ProductUS

Microsoft 365

Microsoft's cloud productivity and email suite.

Microsoft 365 sign-in pages were the credential target of a hotel WiFi DNS-poisoning campaign that ReliaQuest reported on 23 July 2026; the login flow was spoofed, not Microsoft 365 itself.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

How are attackers spoofing Microsoft 365 logins via hotel WiFi?

Timeline for Microsoft 365

#13 28 Aug

Mentioned in: Singapore flags two exploited SharePoint flaws

Cybersecurity: Threats and Defences

#12 22 Jul

Hotel WiFi steers guests to fake logins

Cybersecurity: Threats and Defences

#2 15 May

Mentioned in: Publisher AI adoption hits 93% in Q4 2025

Media's AI Pivot

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

Microsoft 365 is Microsoft's cloud productivity and email suite, used widely across corporate environments. It featured in reporting as the credential target of a hotel WiFi campaign: compromised routers used DNS poisoning to redirect guests to counterfeit Microsoft 365 sign-in pages, harvesting corporate credentials from travellers across several American cities plus India and Saudi Arabia.

The counterfeit pages harvested corporate credentials from hotel guests, not any data from Microsoft's own servers; ReliaQuest's 23 July report found no compromise of the Microsoft 365 service itself.

Common Questions

What is Microsoft 365?

Microsoft 365 is Microsoft's cloud-based productivity and email suite, including Outlook, Teams and SharePoint, used by organisations for corporate identity and communication.Source: ReliaQuest hotel WiFi campaign findings

How did hotel WiFi routers steal Microsoft 365 credentials?

Compromised hotel routers used DNS poisoning to redirect guest lookups to attacker-controlled, counterfeit Microsoft 365 sign-in pages, harvesting typed credentials with no phishing email or malware needed.Source: ReliaQuest hotel WiFi campaign findings

Was Microsoft 365 itself hacked in the hotel WiFi campaign?

No. The compromise targeted the login flow via poisoned hotel router DNS responses, not Microsoft's own infrastructure or the Microsoft 365 service itself.Source: ReliaQuest hotel WiFi campaign findings

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 3 August 2026. Editorial standards.