An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials. [...]
Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins
Summary + source link. No paywalls, no tracking.