You land, check into your conference hotel, and drop your bag on the bed. First instinct: open your laptop, connect to the Wi-Fi, check email. The network name looks right. The captive portal page looks right. You click "Accept and Connect," and you're in.
Nothing about that moment feels dangerous. That's the point.
The router isn't yours — and it isn't clean
The Wi-Fi gateway you just joined isn't managed by hotel IT in any meaningful sense. It's a shared appliance, sitting on a management interface that's been exposed to the internet for months, protected by a default or reused admin password nobody ever bothered to change.
Researchers at ReliaQuest recently mapped out exactly this scenario: attackers scanning the internet for hotel and conference-venue Wi-Fi gateways, breaking in through exposed SSH, SNMP, or web admin consoles, and quietly taking control. Once they're in, they don't deface anything or lock you out. They do something far quieter — they change how the router answers DNS questions.
That's the whole attack, really. Not malware on your laptop. Not a fake Wi-Fi network with an evil twin name. Just a small, silent edit to the address book your device trusts by default.
The lookup you never see
Every time your laptop tries to reach a website, it asks the network "where do I find this?" before it asks "what does this page say?" That first question — the DNS lookup — normally gets an honest answer.
On a poisoned router, it doesn't. You type in your usual login page. Your laptop asks the router where to find it. The router — now working for someone else — lies, and points you toward infrastructure the attacker controls instead.
Your browser still shows what looks like the right destination. There's no red padlock warning, no obvious redirect, no moment where anything feels wrong. You're on what appears to be your normal sign-in page, so you do what you always do: you sign in.
The part that should actually worry you
Here's where this campaign gets uncomfortable, even for people who consider themselves careful. Multi-factor authentication is supposed to be the safety net under all of this. If someone steals your password, MFA is meant to stop them cold.
Researchers found this campaign doesn't bother stealing your password at all. Instead, the attacker-controlled infrastructure serves up a device-code login flow — the same kind of "go to this page and enter this code" prompt you'd see when signing into a smart TV app or a new device. You enter the code because it looks like a routine step. And with that, the attacker walks away with a fully authenticated session, MFA and all, without ever touching your credentials directly.
You didn't get phished in the traditional sense. You didn't fall for a fake login page or a typo'd domain. You did everything "right" and still handed over the keys.
This isn't a hypothetical
This is an active campaign, and it isn't small. Compromised gateways have turned up across multiple U.S. cities, India, and Saudi Arabia, hitting travelers from finance, legal, healthcare, energy, and retail organizations. Researchers say the technique closely resembles tradecraft previously linked to APT28 — the Russian military intelligence group also known as Fancy Bear — which has a track record of exactly this kind of router-level DNS tampering.
One compromised gateway doesn't attack one laptop. It sits at the edge of the network for every device that connects that day. A single successful break-in can quietly touch every guest who logs in during a conference, a trade show, or a busy travel week.
What actually stops this
The uncomfortable truth is that none of the usual advice — "look for the padlock," "check the URL" — reliably catches this, because the URL and the certificate can look completely normal while the DNS answer underneath them is lying. The fix has to happen at a different layer:
- Always-on, full-tunnel VPN on corporate devices. This routes DNS requests through your own trusted resolvers before they ever reach the hotel gateway, which closes the door on this attack entirely.
- Disable Web Proxy Auto-Discovery (WPAD) on managed devices, so they can't be silently pointed at attacker-controlled proxy configs.
- Train people to be suspicious of device-code prompts, not just fake login pages. "Enter this code on another screen" should raise the same eyebrow as "click this link" — especially on a network you don't control.
- Treat every public or shared Wi-Fi network as hostile by default — hotel, conference center, airport, coworking space. The network being "official-looking" tells you nothing about who's actually running the equipment behind it.
The takeaway
You didn't do anything wrong by connecting to hotel Wi-Fi and checking your email. That's just Tuesday for a business traveler. The problem was never your judgment — it was that the network itself was compromised before you ever showed up, and the compromise was engineered to be invisible to exactly the kind of vigilance we usually tell people to practice.
The next time you check into a conference hotel, the safest assumption isn't "this network looks fine." It's "I don't know who's really running this network, so my device shouldn't trust it with anything sensitive." Build your defenses around that assumption, and it stops mattering whether the Wi-Fi looks legitimate — because your traffic never really depends on it in the first place.
Sources: ReliaQuest Threat Spotlight, July 2026; reporting from Infosecurity Magazine and Cyber Security News on the ongoing hospitality-sector DNS poisoning campaign.
