SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

A collection of Microsoft Security Blog posts (late Mar–Apr 2026) describing multiple high‑impact threats and tradecraft observed by Microsoft Threat Intelligence: SOHO router compromises by Forest Blizzard that enable DNS hijacking and adversary‑in‑the‑middle operations; an AI‑enabled device‑code phishing campaign that automates live authentication code generation and enables large‑scale account takeover and MFA bypass; Storm‑1175’s rapid Medusa ransomware operations exploiting recently disclosed web‑facing vulnerabilities; abuse of generative AI by threat actors to scale phishing and bypasss