There was no suspicious email. No questionable attachment. No link the employee should have known better than to click.
The employee simply connected to hotel Wi-Fi and tried to get some work done.
That ordinary moment is now part of a much less ordinary phishing campaign. In July 2026, ReliaQuest disclosed that attackers had compromised Wi-Fi gateways used by hotels and conference centers, manipulated their DNS settings, and redirected travelers toward Microsoft-impersonating infrastructure. The activity had been observed since at least June 2026 and affected shared networks in multiple countries.
The campaign matters because it removes many of the warning signs employees have been trained to recognize.
There may be no strange sender. No urgent request from the CEO. No misspelled domain sitting inside an email. No attachment. No suspicious link.
In some cases, there is no phishing email at all.
That does not make security awareness training useless. It makes training incomplete.
The phish that never reaches the inbox
Most phishing programs begin with the same assumption: an attacker sends something, and an employee has to decide whether to trust it.
Check the sender.
Hover over the link.
Look for spelling mistakes.
Be suspicious of urgency.
Those are useful habits when the threat arrives in an email. But the hotel Wi-Fi campaign begins somewhere else entirely: the network.
ReliaQuest found that attackers were gaining control of captive portal gateways—the infrastructure hotels and conference venues use to provide guest Wi-Fi. Once the gateway was compromised, the attacker could manipulate DNS responses and redirect normal browsing traffic toward attacker-controlled infrastructure.
No malware had to be installed on the employee’s laptop. The attacker did not have to compromise the employee’s inbox. The employee did not have to click a malicious link.
The network itself could influence where the browser went.
From the traveler’s perspective, the experience could look routine. Join the hotel Wi-Fi. Open the browser. See a Microsoft 365 sign-in prompt. Enter your credentials.
That is what makes the attack so effective. It weaponizes a normal business activity rather than asking the employee to do something obviously unusual.
The employee may have done everything right
Imagine an employee traveling for a conference.
They ignored the questionable messages in their inbox. They did not download an unexpected file. They did not respond to an urgent request for money. They connected to the venue’s official Wi-Fi network and attempted to access a service they use every day.
According to the traditional phishing-training playbook, they did everything right.
And they could still be sent to the wrong place.
Security awareness training can teach someone how to evaluate what they see. It cannot tell them that the hotel’s DNS resolver has been tampered with. It cannot stop a compromised gateway from redirecting traffic. It cannot inspect the infrastructure sitting between the employee and the service they are trying to reach.
We should continue teaching people how to recognize suspicious activity. But we should stop building security programs that depend on a tired traveler diagnosing a poisoned network from a hotel room.
Even a real Microsoft login page can be part of the attack
The campaign also included a more complicated variation involving Microsoft’s device-code authentication flow.
Device-code authentication is designed for devices that do not have a convenient keyboard or browser. A device displays a code, and the user enters that code on another device to complete the sign-in.
Attackers can abuse that process by initiating the authentication themselves and persuading the victim to complete it. The user may enter the attacker-generated code on a legitimate Microsoft sign-in page. Because the Microsoft page is real, the usual advice to “check the URL” may not reveal the danger.
The user is not necessarily giving their password directly to a fake website. They are authorizing a session the attacker initiated.
ReliaQuest observed limited use of this technique in the hotel Wi-Fi campaign, creating a path to Microsoft 365 access using valid OAuth tokens. Microsoft describes device-code flow as a high-risk authentication method, notes that a genuine Microsoft sign-in page can make the attack harder to recognize, and recommends blocking the flow wherever possible.
MFA has not necessarily been technically “broken” in this scenario. The user may have successfully completed MFA—just for the wrong session.
That distinction is important. Telling employees to use MFA is still good advice. Treating MFA as a guarantee that every approved sign-in is safe is not.
Training is a layer, not a control plane
Security awareness training plays a real role in a layered security program.
It can help employees recognize social engineering. It can normalize slowing down. It can teach people to verify unusual requests through a second channel. It can make employees more comfortable reporting something that feels wrong.
But training relies on the employee having enough information to make the right decision.
In this attack, much of the important information is invisible to them.
The employee cannot see that the gateway has been compromised. They cannot see which DNS response was forged. They may not know that a code displayed during a Microsoft authentication flow was initiated by someone else.
Training asks the employee to remember.
Technical controls reduce what the employee is required to notice in the first place.
Businesses need both.
The browser is where the risk becomes an action
Whether an attack begins in an email, a text message, a QR code, a search result, a malicious advertisement, or a poisoned Wi-Fi gateway, many attacks eventually converge in the same place: the browser.
That is where the employee sees the destination.
It is where a fake login page asks for a password.
It is where a lookalike domain impersonates a familiar service.
It is where an unexpected authorization flow asks the employee to approve something.
And it is where a suspicious situation becomes an actual credential compromise.
Email security protects the inbox. Endpoint security protects the device. Identity controls protect access. Network controls protect the connection.
Browser-level security adds protection at the moment the person is deciding whether to trust what is in front of them.
Haven is built for that moment. It can verify links, flag lookalike domains, and help ensure employees reach the legitimate sensitive sites their organization has chosen to protect. It works across the browser rather than relying on the threat to arrive through email.
But this campaign also demonstrates why no single product should be treated as the entire answer.
Haven does not repair a compromised hotel gateway. It does not replace an always-on VPN. And when an attacker persuades someone to approve a malicious session through a legitimate Microsoft device-code page, identity policy remains essential.
The answer is not to replace one incomplete layer with another. It is to close the gaps between them.
What a stronger defense for business travelers looks like
Organizations should approach this campaign as a defense-in-depth problem.
1. Enforce an always-on, full-tunnel VPN
ReliaQuest identifies an always-on, full-tunnel VPN as the primary defense against the gateway-level technique it observed. Full tunneling routes traffic—including DNS requests—through the organization’s trusted network rather than allowing the hotel gateway to handle it.
The important words are always on and full tunnel. A VPN employees must remember to activate after connecting may leave a window of exposure. Split tunneling may also allow some relevant traffic to bypass the corporate tunnel.
2. Use strict encrypted DNS where appropriate
Strict DNS over HTTPS or DNS over TLS can prevent the local gateway from forging DNS responses, provided plaintext fallback is disabled. Opportunistic encryption that quietly falls back to unencrypted DNS does not close the same gap.
3. Restrict device-code authentication
Microsoft recommends blocking device-code flow wherever possible. Organizations should review sign-in logs to identify legitimate dependencies, begin with a report-only Conditional Access policy, and create tightly controlled exceptions only where the flow is genuinely required.
Microsoft’s security defaults also block device-code authentication, and new Microsoft Entra tenants have included that protection by default since July 1, 2026.
4. Disable WPAD where it is not needed
ReliaQuest also observed attempts to abuse Web Proxy Auto-Discovery, or WPAD, as another way to redirect traffic. Organizations that do not require automatic proxy discovery should consider disabling it and limiting proxy configuration retrieval to approved internal hosts where it remains necessary.
5. Update the training—not just the training frequency
Employees should understand that phishing does not always begin with an email.
Training for business travelers should include unexpected sign-in prompts, public Wi-Fi risks, fake captive portals, and device-code requests. Employees should never enter an authentication code they did not knowingly generate through a process they initiated.
The lesson should not simply be “look more carefully.”
It should be: when the context changes unexpectedly, stop and verify through a known path.
6. Add protection at the browser
When an attack leads to a fake login page, suspicious link, or lookalike domain, browser-level protection can intervene where inbox-focused controls no longer have visibility.
For organizations using Haven, sensitive sites can be defined and protected across the team, while suspicious links and impersonated destinations can be flagged before a routine browsing action becomes a compromise.
Stop asking employees to be perfect
The lesson from this campaign is not that employees cannot be trusted.
It is that employees should not have to be perfect.
A traveler should be able to join a hotel network without personally auditing the gateway. An employee should not need to understand OAuth architecture to know whether an authentication flow is safe. A busy person should not be the only control standing between an attacker and a Microsoft 365 account.
People should be part of the defense—not the entire defense.
Security awareness training helps people make better decisions. Network, identity, browser, email, and endpoint controls make sure one imperfect decision does not become a business-wide incident.
Attackers are removing the tells employees have been trained to spot.
Businesses have to remove the opportunity.
Protect the moment training cannot
Haven for Business adds protection in the browser, where suspicious links, lookalike domains, and fake login pages turn into real business risk.
See how Haven can help protect your team wherever work takes them.
Frequently asked questions
What is phishing without a phishing email?
Phishing without an email uses another route to place a fraudulent page, authorization request, or impersonated service in front of the victim. The attack may begin through a compromised Wi-Fi network, search result, QR code, text message, advertisement, or malicious browser redirect rather than an email.
Can hotel Wi-Fi redirect someone to a fake Microsoft login?
A compromised Wi-Fi gateway can manipulate DNS responses or proxy settings to redirect connected devices toward attacker-controlled infrastructure. ReliaQuest observed this technique being used against travelers on hotel and conference-center networks.
Does MFA stop this kind of phishing?
MFA remains an important security control, but it does not stop every authentication attack. In device-code phishing, a victim may complete authentication on a legitimate Microsoft page while unknowingly authorizing a session initiated by the attacker. Microsoft recommends blocking device-code flow wherever possible.
Does a VPN protect employees on hotel Wi-Fi?
An always-on, full-tunnel VPN can prevent the gateway-level DNS poisoning technique described by ReliaQuest by routing DNS and other traffic through trusted corporate infrastructure. A manually activated or split-tunnel VPN may not offer the same coverage.
How does Haven help protect business travelers?
Haven adds protection inside the browser. It verifies links, flags lookalike domains, and helps employees reach legitimate sensitive sites even when a suspicious destination did not originate in their inbox. Haven complements—not replaces—VPN, identity, endpoint, and security-awareness controls.
