SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

Collection of Microsoft Security Blog posts (Mar–Apr 2026) detailing multiple high-impact campaigns and tradecraft. Key items: Forest Blizzard (Russian-linked) compromising insecure SOHO routers to perform DNS hijacking and adversary‑in‑the‑middle attacks; an AI‑enabled device‑code phishing campaign that dynamically generates authentication codes to scale account compromise and facilitate MFA bypass; Storm‑1175 conducting high‑tempo Medusa ransomware operations by weaponizing recently disclosed web‑facing vulnerabilities; a supply‑chain compromise of Axios npm packages attributed to North‑Kore