A new widespread DNS poisoning campaign is targeting hotels and conference venues to steal corporate login credentials from visitors. Cybersecurity analysts at ReliaQuest have reported that routers used for public Wi-Fi are being compromised globally, including in the US, India, and Saudi Arabia.
The attackers exploit exposed management interfaces and weak admin login credentials to modify router settings and redirect web traffic through their own infrastructure, allowing them to harvest usernames, passwords, and other sensitive data without user awareness. The campaign particularly affects corporate business travelers. Recommendations to prevent such attacks include enforcing VPN use, auditing proxy logs, and validating website URLs before entering credentials.