Russia Hacked Routers to Steal Microsoft Office Tokens

Multiple high-impact incidents and trends: Russia-linked operators exploited known flaws in legacy routers to mass-harvest Microsoft Office authentication tokens from over 18,000 networks without deploying malware. A stealthy phishing-as-a-service called “Starkiller” proxies real login pages to capture credentials and MFA codes. Large IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that compromised millions of devices have been targeted by international takedowns, but Kimwolf remains disruptive (including attacks on the I2P anonymity network) and its operator (“Dort”) has been doxxed/linked to