AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Microsoft 365 DNS Hijacking Attacks
Coverage from Security Affairs, Krebs on Security, and others
These attacks exploit the network path between users and Microsoft 365 rather than relying only on malicious email or stolen passwords.
Adversaries alter DNS settings on vulnerable SOHO routers or hospitality Wi-Fi gateways, redirecting users to phishing pages or adversary-in-the-middle infrastructure that can capture credentials, OAuth tokens, cookies, or device-code authorizations. Reported activity has affected government and commercial organizations, including travelers using hotel and conference-center networks. Incidents attributed to groups such as APT28 and Midnight Blizzard highlight how compromised network equipment can undermine otherwise successful authentication and multifactor protections.
Looking Back
119 Day Timeline
Apr 7
Apr 28
May 16
Jun 6
Jun 24
Jul 15
Aug 2
All Articles12 articles
Important
In June 2026, researcher Volodymyr Bob Diachenko uncovered FortiBleed, a leaked credential set exposing valid Fortinet firewall logins worldwide via an access-brokering vendor.
6/24/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Microsoft and Lumen reported that Russia-backed Forest Blizzard used DNS hijacking on 18,000 vulnerable SOHO routers during December 2025 to intercept OAuth tokens from Microsoft users.
4/7/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft identified a Midnight Blizzard campaign compromising hospitality Wi-Fi networks worldwide to steal Microsoft 365 credentials through fraudulent captive-portal pages.
8/3/2026 • Cybersecurity (Privacy-Relevant) • General
SOCRadar linked FortiBleed credential theft from exposed Fortinet FortiGate devices to INC and Lynx ransomware groups in 2024-2025 investigation findings.
7/1/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft reported Storm-2949 targeting Microsoft 365 and Azure production environments in social-engineering-driven credential theft and data exfiltration activity.
5/19/2026 • Cybersecurity (Privacy-Relevant) • General
Microsoft and Black Lotus Labs report that APT28 used router-based DNS hijacking and AiTM in FrostArmada during 2025, stealing Microsoft credentials and OAuth tokens.
4/7/2026 • Cybersecurity (Privacy-Relevant) • General
Interesting
Hudson Rock reported a Fortinet firewall and VPN credential theft campaign in more than 15 countries, involving large-scale device compromises and potential intrusions at companies and agencies.
6/18/2026 • Cybersecurity (Privacy-Relevant) • General
ReliaQuest reported DNS manipulation on compromised Wi-Fi gateways that redirected travelers to fraudulent Microsoft 365 login portals in the United States, India, and Saudi Arabia.
7/24/2026 • Cybersecurity (Privacy-Relevant) • General
Huntress reported June 12 to 26 password-spraying activity against Microsoft 365 that used ROPC OAuth to bypass MFA and compromise 78 accounts.
7/1/2026 • Cybersecurity (Privacy-Relevant) • General
Qianxin XLab reported AryStinger malware compromising over 4,000 outdated D-Link routers to execute distributed scanning, DNS hijacking, and traffic monitoring.
6/21/2026 • Cybersecurity Tech (Privacy-Relevant) • General
APT28 used DNS hijacking through compromised SOHO routers to intercept traffic and harvest credentials across 23 US states, with federal disruption ordered in April.
6/1/2026 • Cybersecurity (Privacy-Relevant) • General
CubePilot reported a July 24 DNS hijacking of cubepilot.org in Australia that enabled traffic interception and fraudulent TLS certificates, with possible credential capture.
7/28/2026 • Cybersecurity (Privacy-Relevant) • General