Cybersecurity researchers have identified a phishing campaign that compromises Wi-Fi equipment at hotels and conference centres to redirect business travellers to fake Microsoft 365 login pages. Because the attack manipulates the network itself rather than relying on a suspicious email or link, victims can be shown what looks like a genuine Microsoft sign-in screen after simply connecting to what they believe is legitimate hotel internet, making it particularly dangerous for professionals travelling for work.

The campaign, identified by cybersecurity firm ReliaQuest, has reportedly been active since at least June, with compromised Wi-Fi gateways found in several US cities. Organisations connecting through the affected networks span financial services, professional services, legal, healthcare, energy and retail, suggesting the attackers are targeting travelling employees broadly rather than focusing on one particular industry.