For years, the advice was simple: avoid public Wi-Fi because someone nearby might be snooping on your internet traffic. It was sound guidance at the time, but today’s attacks look very different. The biggest threat is no longer the person sitting in the corner of the coffee shop with a laptop running packet capture software. Instead, attackers are increasingly targeting the infrastructure that provides the Wi-Fi itself.
A recent campaign reported by SecurityWeek illustrates just how far these attacks have evolved. Rather than luring users onto fake wireless networks, attackers compromised legitimate hotel Wi-Fi gateways to harvest Microsoft 365 credentials from unsuspecting business travelers. It is a significant shift that reflects how enterprise security has changed over the last decade.
From Traffic Theft to Identity Theft
Ten to fifteen years ago, public Wi-Fi attacks were relatively straightforward. Many websites still relied on HTTP or only encrypted the login process. An attacker connected to the same wireless network could capture traffic, steal session cookies, or even recover usernames and passwords with readily available tools. Applications such as Firesheep demonstrated just how easy session hijacking had become, and security professionals responded with a familiar warning: avoid public Wi-Fi whenever possible.
Fortunately, widespread adoption of HTTPS dramatically reduced the effectiveness of those attacks. Encryption became the norm, making passive eavesdropping far less valuable. As organizations strengthened transport security, attackers adapted.
Today, rather than intercepting unencrypted traffic, attackers focus on something much more valuable: cloud identities.
The Network Has Become the Target
The recent campaign highlighted by SecurityWeek demonstrates this evolution perfectly. Instead of creating rogue wireless networks with names like “Free Airport Wi-Fi,” the attackers compromised the legitimate Wi-Fi gateway used by hotels and conference centers.
Once they gained control of the gateway, they modified DNS settings to redirect users attempting to sign in to Microsoft 365. Victims remained connected to the real hotel network and saw what appeared to be a normal Microsoft authentication prompt. Behind the scenes, however, the attackers acted as a proxy between the victim and Microsoft’s legitimate authentication service.
This technique, known as an Adversary-in-the-Middle (AitM) attack, allows the attacker to relay authentication traffic in real time. The user successfully signs in, Microsoft successfully authenticates the user, and the attacker quietly captures credentials and, in many cases, authenticated session cookies that can bypass traditional multi-factor authentication protections.
That is a very different attack than simply reading someone else’s network traffic.
Why HTTPS Is No Longer the Whole Story
HTTPS remains one of the most important security improvements of the modern web, but it addresses only one part of the problem.
Encryption protects the confidentiality of data while it is being transmitted. It does not automatically guarantee that every authentication request reaches its intended destination without interference. Modern phishing frameworks are designed to relay encrypted sessions while presenting convincing login experiences to victims.
In the recent campaign, compromised DNS settings redirected authentication requests through attacker-controlled infrastructure before forwarding them to Microsoft’s legitimate services. To the user, everything appeared to work normally. The login succeeded, but so did the attack.
This is one reason identity-focused attacks have become such a concern for security teams.
Why Business Travelers Are Attractive Targets
Hotels and conference centers bring together employees from hundreds of organizations under a single network. Business travelers also expect to encounter captive portals, redirects, and unfamiliar authentication prompts while connecting to wireless networks, making suspicious behavior easier to overlook.
Researchers observed victims spanning industries including financial services, healthcare, legal, retail, energy, and professional services. A single compromised hotel gateway can therefore provide attackers with access to employees from dozens of organizations, dramatically increasing the return on investment for the attack.
Once a Microsoft 365 account is compromised, the attacker may gain access to Exchange Online, Teams, SharePoint, OneDrive, and other cloud services. Depending on the user’s role and the organization’s security controls, that access can become the first step toward business email compromise, sensitive data theft, or broader enterprise intrusion.
Modern Defenses Require an Identity-First Mindset
The evolution of these attacks reinforces an important lesson: securing the network alone is no longer enough. Organizations must also protect identities.
Phishing-resistant authentication methods such as FIDO2 security keys and passkeys significantly reduce the effectiveness of adversary-in-the-middle attacks because they cryptographically bind authentication to the legitimate website. Conditional Access policies that evaluate device health, location, and sign-in risk can further limit the impact of stolen credentials or session tokens.
VPNs still have value by encrypting traffic between a device and the VPN endpoint, but they should not be viewed as a complete defense. If users are tricked into authenticating to a phishing site, or if the attack occurs before the VPN is established, encrypted tunnels alone cannot prevent credential theft. Continuous monitoring for impossible travel events, unfamiliar devices, anomalous sign-ins, and suspicious session activity remains equally important.
The Biggest Shift Is What Attackers Want
The most significant change is not the technology used to compromise hotel Wi-Fi. It is the objective. A decade ago, attackers wanted to steal traffic. Today, they want to steal identity. Modern organizations rely on cloud identity as the gateway to email, collaboration platforms, file storage, and administrative systems. Once an attacker possesses a valid Microsoft 365 session, they may never need to compromise the victim’s laptop directly. They can operate entirely within cloud services, often making detection more difficult and increasing the potential business impact.
Public Wi-Fi is still worth treating with caution, but the reasons have changed. The greatest risk is no longer someone listening to your network traffic. It is someone quietly positioning themselves between you and the services your organization depends on every day.
As attackers continue to shift their focus toward identity, organizations must do the same. Protecting users now means going beyond encrypted connections and building defenses that verify who is authenticating, what device they are using, and whether that access should be trusted. In today’s cloud-first world, protecting identity is ultimately protecting the organization itself.
