Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

Microsoft has attributed a global campaign against hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. The operation used custom malware on hotel Wi-Fi infrastructure to compromise travelers’ Microsoft 365 accounts. The campaign sits at the intersection of physical-network access and cloud identity: guests and staff who authenticate from compromised hotel networks become the entry point into corporate M365 tenants.

Technically, the reported path is network-level compromise first, then credential or session abuse against Microsoft 365. Custom malware on hospitality Wi-Fi can intercept, manipulate, or sit alongside captive-portal and guest authentication flows that many business travelers treat as routine. Once an account or token is exposed on that path, the attacker can reach mail, documents, and admin-adjacent surfaces without needing a separate endpoint implant on every target laptop.

For engineers and builders, the risk is not only “untrusted Wi-Fi” as a generic warning. Identity and session design often assume the access network is hostile only in the abstract, while travelers still sign into M365 from hotel SSIDs, complete device registration, or refresh long-lived tokens on those links. Conditional access, device compliance, and continuous access evaluation matter more when the first hop is a hospitality network that a nation-state actor has already wired for custom malware.

In market and competitive terms, this fits a familiar APT29 pattern: high-value intelligence collection through identity and cloud services rather than noisy ransomware-style disruption. Microsoft 365 is a dense target because it concentrates email, collaboration, and directory data for enterprises that travel heavily. Hospitality Wi-Fi is an attractive intermediate because it is shared, operationally complex, and rarely under the same security ownership as the corporate tenant being attacked.

Practical takeaway: treat hotel and guest networks as hostile for any Microsoft 365 session that carries corporate mail or directory access. Prefer managed VPN or private access before interactive sign-in, enforce phishing-resistant MFA and token-binding where available, and watch for anomalous sign-ins from hospitality ASN or captive-portal paths. What to watch next is Microsoft’s technical follow-through on how the custom malware bridges Wi-Fi compromise to M365 account takeover, and whether hospitality operators publish hardening guidance for the same attack surface.