TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts

TP-Link has issued a warning about a botnet that exploits two vulnerabilities to infect small office/home routers, which are then used to attack Microsoft 365 accounts. According to TP-Link, the affected models include the Archer C7 and TL-WR841N/ND, though other devices may also be at risk, and updates have been released despite these routers being end-of-life.

The two flaws are tracked as CVE-2025-50224, which can enable password theft from the router, and CVE-2025-9377, a parental control command injection RCE that allows attackers to run code on the device. The botnet, named Quad7 (also known as 7777), uses the infected routers to perform password-spraying against Microsoft 365 accounts.

Detection remains difficult as the botnet uses thousands of IP addresses from home users and small businesses, and TP-Link urges owners to install the updated firmware or switch to a supported router. CISA has issued advisories for the two flaws, and mitigation steps include using strong, unique passwords and enabling MFA for Microsoft 365 accounts.