Russia Hacked Routers to Steal Microsoft Office Tokens

Multiple high-impact cyber incidents and trends: Russian military-linked actors exploited known vulnerabilities in older consumer routers to mass-harvest Microsoft Office authentication tokens from over 18,000 networks without deploying malware. A new phishing-as-a-service called “Starkiller” proxies real login pages and relays credentials and MFA codes to bypass MFA protections. Large IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) have been implicated in record DDoS campaigns and recent law-enforcement actions disrupted their infrastructure; Kimwolf also overwhelmed the I2P anonymity network