APT28 hijacks DNS settings on vulnerable routers to steal credentials
The UK NCSC reports that APT28 has exploited vulnerable routers to change DHCP/DNS settings and run adversary-in-the-middle attacks that harvest passwords and OAuth tokens, including against Outlook-related domains.
