Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #136 July 27, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare podcast. Today, we are covering an emerging cyber campaign that is turning public Wi-Fi infrastructure into a powerful weapon for stealing corporate Microsoft 365 accounts. And the key issue is not simply that public Wi-Fi has always been considered risky, it is that attackers are now compromising the network infrastructure itself, allowing them to manipulate trusted authentication traffic before traditional security controls have a chance to respond. Here's what happened. Security researchers have identified an active campaign targeting public Wi-Fi gateways deployed in hotels, conference centers, and other shared venues frequently used by business travelers. The activity has been ongoing since at least June 2026 and has been observed across multiple locations, including the United States, India, and Saudi Arabia. Instead of sending phishing emails or distributing malware, The attackers first compromise the gateway appliances that control guest internet access. Once administrative access is obtained, they modify the gateway's DNS configuration. DNS is responsible for translating website names into network addresses. By controlling DNS responses, attackers can silently redirect users attempting to access legitimate Microsoft 365 services to attacker-controlled infrastructure that closely imitates Microsoft's authentication process. From the user's perspective, everything appears normal. There is no suspicious email. No malicious attachment, no unexpected software installation. The employee simply connects to the hotel Wi-Fi and is presented with what appears to be a legitimate Microsoft authentication request. Researchers also observed the abuse of Microsoft's device code authentication flow in certain cases. Rather than intercepting passwords, attackers persuade victims to approve an authentication request that ultimately grants valid OAuth tokens to the attacker-controlled session. This enables access that already satisfies multifactor authentication requirements. without requiring attackers to defeat MFA directly. The campaign also demonstrated attempts to abuse web proxy auto discovery, commonly known as WPAD. If successful, this can expand the amount of application traffic routed through attacker-controlled infrastructure, increasing both visibility and opportunities for credential theft. While the techniques resemble tradecraft previously associated with APT 28, the available evidence does not confirm that the current campaign is being conducted by the same threat actor. The observed similarities relate to tactics and techniques rather than confirmed infrastructure or operational attribution. For organizations, the most effective defensive measure is enforcing an always on full tunnel VPN across all corporate devices. This ensures that DNS requests and authentication traffic are routed through trusted enterprise infrastructure and Before they ever reach an untrusted public network, security teams should also review whether Microsoft device code authentication is required across their environment and disable it where it serves no legitimate business purpose. WPAD should be disabled if unnecessary, authentication logs should be reviewed for unusual sign inactivity, and employees should be trained to question unexpected Microsoft authentication prompts while connected to public networks. The strategic lesson is clear. Identity security no longer depends solely on protecting endpoints or preventing phishing emails. Attackers increasingly target the infrastructure users trust every day. Organizations must assume that any public network can become part of the attack chain and design authentication controls that remain secure even when the underlying network cannot be trusted. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.