Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins

An international takedown disrupted 'FrostArmada,' an APT28 campaign that hijacked DNS on compromised MikroTik, TP-Link and other routers to route authentication traffic through attacker-controlled proxies, enabling adversary-in-the-middle collection of Microsoft 365 credentials and OAuth tokens; the activity affected ~18,000 devices across 120 countries, targeted government and hosting entities, and included published IoCs and mitigation guidance.