[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7OAJQ5JL5CsrvcTyLPSDs769dK6asaVrxQ2JCeWQhC4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38},"b84c4a9e-b62f-49a2-ad77-f6b7732ef83e","router-dns-hijacking-campaign-compromises-18000-devices-globally","c1a20bc8-2b59-4cbc-a118-ba3041e67a2d","Router DNS Hijacking Campaign Compromises 18,000 Devices Globally","The FrostArmada campaign exploited weak default configurations and unpatched vulnerabilities in MikroTik and TP-Link routers to perform DNS hijacking attacks. Attackers modified DNS settings to redirect authentication traffic through malicious proxies, enabling them to steal Microsoft 365 credentials and OAuth tokens from victims. This attack demonstrates how compromised network infrastructure can be weaponized to intercept sensitive authentication data, potentially giving attackers persistent access to corporate systems and data.","**Immediate actions:**\n- Change default credentials on all network devices and implement strong authentication\n- Verify and harden DNS settings on routers to prevent unauthorized modifications\n- Scan all internet-facing routers for known vulnerabilities and apply security patches\n\n**Long-term improvements:**\n- Implement automated firmware update processes for network appliances\n- Deploy network monitoring to detect unusual DNS query patterns or configuration changes\n- Establish regular security audits of router configurations and access controls\n\n**Detection measures:**\n- Monitor authentication logs for suspicious login patterns or token usage\n- Implement DNS monitoring to identify unexpected query redirections\n- Deploy endpoint detection tools to identify compromised OAuth tokens",[12,13,14,15,16,17],"CIS Control 1","CIS Control 7","CIS Control 12","NIST CM-2","NIST CM-6","NIST SI-2","published","2026-04-07T17:08:17.160624+00:00","2026-04-07T17:08:17.058+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fauthorities-disrupt-dns-hijacks-used-to-steal-microsoft-365-logins\u002F","authorities-disrupt-router-dns-hijacks-used-to-steal-microsoft-365-logins","Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[]]