Russia Hacked Routers to Steal Microsoft Office Tokens

Multiple high-impact cyber incidents reported: Russian state-linked hackers exploited known vulnerabilities in older Internet routers to mass-harvest Microsoft Office authentication tokens from users on >18,000 networks without malware; a stealthy phishing-as-a-service called “Starkiller” proxies real login pages to capture credentials and MFA codes; the Kimwolf IoT botnet (and related botnets Aisuru, JackSkid, Mossad) were disrupted by law enforcement but remain notable for massive DDoS and abuse (Kimwolf also flooded the I2P anonymity network); a worm named CanisterWorm targets Iran by pivot