DNS Hijacks Used to Steal Microsoft 365 Logins

On April 7, 2026, international law enforcement agencies—working with Microsoft and private-sector researchers—disrupted a large-scale DNS hijacking operation that was actively stealing Microsoft 365 credentials by manipulating internet routers worldwide. [bleepingcomputer.com]

The campaign, tracked as FrostArmada, was linked to APT28 (also known as Fancy Bear, Forest Blizzard, or STRONTIUM), a Russia-backed cyber‑espionage group associated with GRU military unit 26165. [bleepingcomputer.com], [ncsc.gov.uk]

Authorities involved in the takedown included:

• The FBI
• The U.S. Department of Justice
• The Polish government
• Microsoft and Lumen’s Black Lotus Labs

Together, they dismantled key attacker-controlled infrastructure used to redirect traffic and steal credentials. [bleepingcomputer.com]

---

How the attack worked (in plain English)

This was not phishing email spam. Instead, attackers compromised routers at the network edge, mainly:

• MikroTik
• TP‑Link
• Some Fortinet and Nethesis firewall models

Once hacked, the attackers:

1. Changed router DNS settings to point to attacker‑controlled servers
2. The router then automatically pushed those DNS settings to every connected device via DHCP
3. When users visited Microsoft login services (e.g., Outlook, Office 365):
   • DNS resolved to the attacker’s server, not Microsoft’s
   • Users were silently redirected to an adversary‑in‑the‑middle (AiTM) proxy
4. Credentials and OAuth tokens were intercepted during login [bleepingcomputer.com], [microsoft.com]

The only visible warning was often a TLS certificate error, which many users ignore—allowing the attack to succeed without malware or phishing emails. [bleepingcomputer.com]

---

Scale and impact

At its peak in December 2025, the FrostArmada campaign:

• Infected ~18,000 routers
• Impacted organizations in 120+ countries
• Targeted:
  • Government agencies
  • Law enforcement
  • IT and hosting providers
  • Organizations running their own servers [bleepingcomputer.com]

Microsoft confirmed the activity was external to Microsoft’s own infrastructure, but was used to intercept traffic specifically to Microsoft 365 and Outlook Web services. [microsoft.com]

---

Why this attack is especially dangerous

This campaign stands out because:

• ✅ No endpoint malware required
• ✅ No phishing emails
• ✅ Bypasses traditional EDR and email security
• ✅ Works even with MFA (via stolen session tokens)
• ✅ Exploits routers, which are often unmonitored

As Microsoft noted, compromised SOHO routers provide nation‑state actors with persistent, passive visibility into downstream enterprise networks. [microsoft.com]