Source: ReliaQuest low-to-medium confidence assessment, July 23, 2026; visibility constraints prevented confirmation.

Source: ReliaQuest, July 23, 2026.

Assessed from ReliaQuest reporting and recommendations, July 23, 2026.

Assessed from ReliaQuest recommendations, July 23, 2026.

Venue-operated Wi-Fi infrastructure sits entirely outside corporate control yet inside employees’ trust boundary — travel and remote-work policy treated hospitality networks as neutral transport, with no compensating controls for a compromised gateway.

No enforced always-on, full-tunnel VPN and no strict-mode encrypted DNS on roaming corporate devices — DNS resolution, including plaintext queries from core Windows services, was left to the untrusted network’s resolver.

Microsoft’s device-code authentication flow was left enabled by default in Entra ID, preserving a token-issuance path that satisfies MFA for a session the attacker initiated — no Conditional Access policy restricted it.

WPAD remained enabled by default across the Windows fleet, with no restriction of proxy auto-configuration (PAC) retrieval to approved internal hosts and no auditing of proxy authentications from unknown infrastructure.

No traveling-employee security baseline — staff were not trained to verify sign-in URLs and certificates on venue networks or to treat unexpected device-code prompts as reportable security events rather than routine friction.

Configure the VPN to establish automatically on network connection and block all internet access until the tunnel is active; audit and eliminate split-tunneling exceptions. Pair it with DNS-over-HTTPS or DNS-over-TLS in strict mode — plaintext fallback disabled — because opportunistic mode falls back to exactly the plaintext query the gateway forges. ReliaQuest identifies full-tunnel VPN as the single control that closes the primary exposure.

Create a Conditional Access policy blocking the device-code grant for all users by default. Where genuinely required — shared meeting-room displays, browserless IoT — scope a narrow exception group, restrict it by named location, and recertify membership on a 90-day cycle. The flow has few legitimate uses for most user populations, and blocking it removes the authentication path this campaign’s token theft depends on.

Disable the WinHttpAutoProxySvc service via Group Policy wherever automatic proxy discovery is not required; where it is, restrict PAC-file retrieval to approved internal hosts only. Add detection for wpad.dat retrievals resolving to external IP addresses and review proxy authentication logs for sessions transiting infrastructure your organization does not operate.

Write the assumption into policy: no venue network is trusted transport. Issue corporate hotspots or vetted eSIM data plans to high-risk travelers (executives, finance, legal, M&A), require the full-tunnel VPN before any corporate resource is reachable, and include venue network risk in due diligence for offsites and sponsored conferences. Deliver the user-facing rules below (5B) as a standing travel-security briefing.

Make it the first thing you do on any hotel, conference, or airport Wi-Fi — before email, before the browser. If the VPN will not connect, do not work around it: switch to your phone’s mobile hotspot instead.

2.  Prefer mobile data over venue Wi-Fi for any sign-in.

Your phone’s 4G/5G connection does not pass through the hotel’s equipment. For anything involving a password — email, banking, corporate apps — the hotspot is the safer road.

3.  Check the address bar before typing your password.

Genuine Microsoft sign-ins happen on login.microsoftonline.com — not on look-alikes built from pieces like “ms365”, “owa”, or “live”. If the address looks even slightly off, stop.

4.  Never approve a sign-in prompt or code you did not start yourself.

If a page or app asks you to “enter this code” or approve a sign-in you did not initiate seconds earlier, that approval is the attack. Close it and report it — approving it hands a criminal a fully valid session, MFA included.

5.  Something feels wrong? Disconnect and report it.

Unexpected redirects, certificate warnings, or a login page that looks unusual on venue Wi-Fi: disconnect, switch to mobile data, and tell your security team which venue and network it was. Reporting is never an overreaction — your report may protect every colleague who connects after you.

Cyber hygiene and training, access control, and multi-factor / secured communications are explicit risk-management obligations for essential and important entities. A confirmed compromise of an employee’s account at an in-scope entity triggers the 24-hour early warning and 72-hour notification to the national CSIRT — regardless of the fact that the intrusion began on a hotel’s network rather than the entity’s own.

This campaign is the textbook argument for Zero Trust’s first premise — the network is always assumed hostile. SC-20/SC-21 require secure, validated name resolution; AC-17 governs remote access; IA-2 covers authentication of remote sessions. Location-based trust fails precisely where employees actually work.

Authentication-information handling (5.17), awareness (6.3), network security (8.20), security of network services (8.21), and web filtering (8.23) are all engaged. For a certified ISMS, roaming devices resolving DNS through arbitrary venue infrastructure without compensating controls is an auditable nonconformity in the remote-working risk treatment.

A hijacked Microsoft 365 account typically exposes mailboxes and files containing personal data. Article 32 requires security measures appropriate to the risk — including for mobile working — and a confirmed account compromise involving personal data triggers the 72-hour notification to the supervisory authority under Article 33.

Financial services organizations were among the observed victim traffic. For EU financial entities, DORA’s ICT risk-management framework (in force since 17 January 2025) extends to remote and mobile working: protecting authentication traffic of traveling staff falls squarely within Article 9 protection-and-prevention measures.

Forward-looking: captive-portal gateway appliances are products with digital elements. CRA’s essential requirements mandate secure-by-default configuration and prohibit shipping with known exploitable weaknesses — internet-exposed management consoles behind weak default credentials are exactly the defect class in scope. From 11 September 2026, manufacturers must report actively exploited vulnerabilities via ENISA’s Single Reporting Platform (24h/72h/14d).

Secure configuration of enterprise assets (Control 4 — WPAD, DNS, VPN posture), network infrastructure management (Control 12 — relevant to any organization operating guest Wi-Fi), and security awareness training (Control 14) are the safeguards most directly engaged.

Hotels and venues operating the compromised gateways in India face CERT-In’s 6-hour incident-reporting directive and data-fiduciary duties under the DPDPA 2023; venues in Saudi Arabia face controller obligations under the Saudi Personal Data Protection Law. [KB UPDATE NEEDED] Saudi PDPL — Personal Data Protection Law (Royal Decree M/19, as amended); scope: processing of personal data in Saudi Arabia; relevant to venue operators and breach notification.

SEG delivers a traveling-employee module covering hostile-network assumptions, sign-in URL and certificate verification, and recognition of device-code and OAuth-consent prompts as attack surface — turning the weakest moment of the journey into a reporting trigger instead of a compromise.

SEG reviews the Microsoft Entra ID tenant — Conditional Access coverage of the device-code flow, token lifetimes, session controls — and builds the governance for full-tunnel VPN and strict-mode DNS across the roaming fleet, so protection does not depend on which network an employee happens to join.

SEG simulates rogue-network and adversary-in-the-middle scenarios against roaming corporate devices to validate that VPN, DNS, and WPAD hardening actually hold — and, for organizations operating guest Wi-Fi themselves, identifies internet-exposed management interfaces before someone else does.

SEG extends third-party risk beyond suppliers to the venues where your people work: network due diligence for offsites, sponsored conferences, and long-stay locations, treating every borrowed network as an attack surface with defined compensating controls.

The perimeter now travels with the employee — and attackers have noticed. The most efficient campaigns of 2026 no longer breach the corporate estate; they compromise the infrastructure employees borrow: hotel gateways, conference Wi-Fi, home routers. One appliance yields every guest, every day, with no phishing email to filter and no malware to detect. Organizations that still define trust by network location will keep losing accounts to networks they have never seen and will never control. The traveling-employee risk program — full-tunnel VPN, identity-layer hardening, and trained skepticism — is no longer hygiene. It is the operative perimeter.

This campaign proves once again that attackers are always one step ahead — and that they no longer need to touch your infrastructure to reach your people. The employee here did everything right: real hotel, real network, the correct Microsoft address typed into the browser. The network itself lied to them. Our advice is to stop asking whether a network is safe and assume it never is. Three controls decide the outcome. A full-tunnel VPN that comes up before any traffic leaves the device. A Conditional Access policy that blocks the device-code flow almost nobody in your organization actually uses — five minutes of work that removes the exact token path this campaign exploited. And employees trained to treat every unexpected sign-in prompt on the road as an incident, not an inconvenience. None of this requires heroics. It requires identifying the asset that is genuinely hard to restore — in this case a valid, MFA-satisfied Microsoft 365 session in an attacker’s hands, which survives a password reset — and investing there before travel season, not after the first hijacked mailbox.