Investigators said the service infected thousands of routers and enabled fraud including crypto account takeovers.