Compromised Public Wi‑Fi Gateways Used to Steal Microsoft 365 Logins

Intelligence Summary

A threat actor compromised public Wi‑Fi gateway appliances and used them to target traveling employees. The activity focused on harvesting credentials tied to Microsoft 365 accounts. Victims may be tricked during sign-in flows or exposed through malicious capture on the network path. This increases the risk of account takeover and subsequent access to corporate email, files, and shared services. Organizations should review access logs, enforce strong authentication, and monitor for suspicious sign-in patterns from gateway-related networks.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics