Your router can be hijacked

An old one, but I learned of it only today. Malware can try to silently change the settings in your home router, guessing the user id and password needed to access the router. If you haven't changed them from factory defaults, it will likely succeed.

All that the malware has to do is to change the DNS setting - the server which translates "www.mybank.com" into an IP address - to a server controlled by the malware author. Now when you try to reach mybank.com, your traffic goes to where the malware author directs it; (s)he can intercept it and also forward it to its right destination.

This WaPo blog describes it further, and how you might protect yourself against it.