You check into the hotel after a six-hour flight. You’re exhausted. You connect to the free Wi-Fi, open your laptop, and navigate to login.microsoftonline.com to check your emails. The browser shows that familiar, comforting green padlock. You type in your password.
And just like that, your corporate credentials are sitting on a server in a country you’ve never visited.
We were taught that the green padlock means safety. It doesn’t. It just means the tunnel is secure—not that it’s going to the right place.
A new wave of attacks is targeting business travelers, and it’s bypassing every security warning you’ve ever been trained to fear. Hackers are hijacking the Domain Name System (DNS) of hotel Wi-Fi networks. When you type in your Microsoft 365 login URL, the compromised network points you to an attacker-controlled server instead of Microsoft’s.
Here’s the terrifying part: you don’t have to click “Proceed to unsafe website.” You don’t have to install a sketchy certificate. The phishing page loads perfectly, secured by a valid HTTPS connection. The browser’s lock icon is green. The URL looks right. The page looks right.
Convenience is the Trojan horse of cybersecurity.
For years, the cybersecurity industry has drilled into us: “Look for the lock. Look for HTTPS.” But this attack exposes the fatal flaw in that logic. HTTPS guarantees encryption, but it doesn’t guarantee destination. If an attacker controls the DNS—the phonebook of the internet—they can route your encrypted traffic straight into their trap.
You don’t get hacked because you’re careless. You get hacked because you followed the rules.
The tension here is undeniable. We demand open, unauthenticated Wi-Fi networks the moment we step into a lobby. We want to connect instantly, without friction. But that lack of friction is exactly what allows attackers to intercept your traffic at the DNS level. The network itself is compromised before you even click “accept.”
So, what do we do? The old advice of “just look for the lock” is officially dead. If you’re traveling for work, using a VPN isn’t a luxury; it’s the only way to bypass the local DNS entirely. If your IT department isn’t enforcing a VPN on all public networks, they are leaving the front door wide open.
The next time you’re in a hotel lobby, staring at that login screen, remember: the padlock only proves the door is locked. It doesn’t tell you who built the house.
FAQ
Q: How does this work without installing a fake certificate on my machine?
A: The attacker controls the network's DNS. They redirect your request for a Microsoft login page to their own server. Their server has a perfectly valid HTTPS certificate for *their* domain, and they visually mimic the Microsoft login page. Your browser sees a valid lock, but you're on the wrong site.
Q: What's the practical implication for business travelers?
A: Never trust public Wi-Fi DNS. If you aren't routing your traffic through a trusted VPN that overrides the local network's DNS, your corporate credentials are at risk every time you connect in a hotel, airport, or cafe.
Q: Is HTTPS completely useless now?
A: No, HTTPS still prevents passive eavesdropping on the network. But it fails completely against active DNS hijacking. HTTPS secures the transport, not the destination. Relying on it as your sole indicator of trust is a fatal mistake.