Unit 42 researchers have detailed "AirSnitch," a set of architectural Wi-Fi attacks lacking a specific CVE-ID, which bypasses WPA2 and WPA3 client isolation to expose enterprise networks.
Proof-of-concept exploits are currently publicly available, allowing authenticated attackers to perform full Man-in-the-Middle (MitM) attacks and intercept sensitive traffic.
Vulnerability Details
Affected Product: All tested Wi-Fi routers and WPA2/WPA3-Enterprise networks
Exploitation Status: Proof-of-Concept (PoC) Available
Risk & Impact
Triage: High Priority (Reassess Wi-Fi segmentation and update firmware)
Attack Vector: Authenticated attackers exploit Layer 2/3 architectural flaws (e.g., MAC spoofing, broadcast reflection) to bypass client isolation and achieve a MitM position.
Ease of Exploit: Medium (Requires existing network access or credentials, but PoC tools are public)
Three proof-of-concept exploits-BlueHammer, RedSun, and UnDefend-are being actively leveraged in the wild to weaponize Microsoft Defender's remediation processes.
While CVE-2026-33825 has been patched, two of the exploits remain unpatched zero-days, allowing threat actors to achieve SYSTEM-level access and degrade endpoint defenses.
Vulnerability Details
Affected Product: Microsoft Defender Antimalware Platform (versions prior to 4.18.26050.3011)
Identifier: CVE-2026-33825 (plus two unpatched zero-days)
CVSS Score: 7.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: High Urgency - Patch immediately and monitor for post-compromise privilege escalation.
Attack Vector: Attackers abuse a Time-of-Check to Time-of-Use (TOCTOU) race condition and flawed remediation logic during Defender's file scanning and cleanup processes to redirect high-privilege file operations.
Ease of Exploit: Low complexity; public proof-of-concept (PoC) code is readily available and being used with minimal modifications.
Action Plan
Immediate Action: Upgrade Microsoft Defender Antimalware Platform to Version 4.18.26050.3011 or later.
Workaround: Restrict execution policies in low-privilege user directories and monitor Defender's background processes (e.g., TieringEngineService.exe).
Detection: Hunt for staged binaries in low-noise user directories (e.g., Pictures, Downloads) using original PoC filenames or lightly obfuscated variants, and monitor for unexpected SYSTEM-level file operations.
Relevant professional terms
TOCTOU (Time-of-Check to Time-of-Use)
A software vulnerability caused by a race condition where the state of a system changes between the time a condition is checked and the time the result is used, often leading to unauthorized actions.
Local Privilege Escalation (LPE)
An attack technique where an adversary with limited, local access to a system exploits a flaw to gain higher-level permissions, such as Administrator or SYSTEM access.
France Titres (ANTS), the French government agency managing official identity documents, confirmed a major data breach. A threat actor exfiltrated sensitive citizen data, highlighting severe risks of identity theft and targeted phishing.
Attack Overview
Attacker: breach3d
Impact Assessment
Data Stolen:19 million records containing PII (names, addresses, birth dates, account metadata).
Operational Impact: No system downtime reported; data is actively being offered for sale on dark web forums.
Detection & Hunting
Detection Guidance: Monitor for anomalous data exfiltration (MITRE T1119) and enforce strict access controls around PII repositories.
Strategic Takeaway
Public sector entities must assume breach and implement robust data segmentation to protect vast repositories of citizen PII.
Relevant professional terms
PII (Personally Identifiable Information)
Any data that can be used to identify a specific individual, such as a full name or national ID number.
Data Exfiltration
The unauthorized transfer of data from a computer or server, typically carried out by malicious actors.
Installing Claude Desktop on macOS silently drops a Native Messaging host manifest into Chromium browsers. This undocumented behavior expands the attack surface by potentially allowing browser extensions to access local executables.
Key TTPs
Initial Access: User installation of the Claude Desktop application for macOS.
Execution: Silently drops a Native Messaging host manifest into multiple Chromium browser profiles.
Defense Evasion: Silent deployment of configuration files without user notification or consent.
Campaign Analysis
While not strictly spyware, this silent configuration creates a bridge between browser extensions and local executables. If abused by malicious extensions, it could lead to unauthorized data extraction outside the browser sandbox.
Targeting & Infrastructure
Target Profile: macOS users installing the Claude Desktop application.
Infrastructure: Affects multiple Chromium-based browsers including Chrome, Edge, Brave, Vivaldi, and Opera.
Relevant Terms
Native Messaging: A protocol allowing browser extensions to communicate directly with native applications installed on a device.
Browser Sandbox: A security mechanism that isolates web browsers from the local operating system to prevent unauthorized system access.
A self-propagating supply chain attack is targeting the npm ecosystem by compromising developer accounts. The worm-like malware steals sensitive credentials and automatically injects itself into other packages the victim can publish.
Key TTPs
Initial Access: Compromised npm publish tokens used to upload malicious packages.
Execution: Malicious scripts execute upon package installation to harvest local secrets.
Defense Evasion: Abuses legitimate npm infrastructure and automated version bumping to mask malicious updates.
Campaign Analysis
The malware acts as a worm, scanning for ~/.npmrc tokens to recursively infect other packages. It targets high-value AI and database endpoints, expanding to PyPI if Python credentials are found.
Targeting & Infrastructure
Target Profile: Developers using AI agent tooling and database operations.
Infrastructure: Leverages the npm registry (and potentially PyPI) for distribution.
Relevant Terms
Supply Chain Attack: A cyberattack that targets a software vendor or repository to compromise downstream users.
CI/CD: Continuous Integration and Continuous Deployment; automated pipelines used by developers to build, test, and deploy code.
Global Spyware Proliferation Threatens Critical Infrastructure
Executive Summary
NCSC Director General Richard Horne warns that over 100 nations now possess advanced spyware, creating a "perfect storm" for businesses and critical infrastructure.
Key Findings
100 countries have acquired cyber intrusion software, drastically lowering the barrier to entry for state-sponsored espionage.
National cyber attacks against the UK have doubled in one year, with the majority linked to state actors.
Advanced Artificial Intelligence tools are rapidly accelerating the detection and exploitation of vulnerabilities at scale.
The Bottom Line
The democratization of commercial spyware and AI-driven exploitation tools means sophisticated cyber capabilities are no longer restricted to top-tier nation-states.
Technical leaders must pivot from assuming they are only targeted by opportunistic criminals to defending against state-level surveillance, mandating zero-trust architectures and rapid vulnerability remediation.
Relevant Terms
Spyware: Malicious software designed to infiltrate devices, monitor user activity, and extract sensitive data without consent.
State Actors: Government-sponsored hacking groups that conduct cyber espionage, sabotage, or warfare to advance national interests.
Paragon Solutions' Graphite is a commercial spyware tool designed to covertly infiltrate mobile devices and intercept encrypted communications. Recently confirmed in use by US law enforcement, it bypasses network defenses by compromising the endpoint directly.
Key Features
Executes zero-click exploits to infect devices without user interaction.
Intercepts end-to-end encrypted messages (e.g., WhatsApp, Signal) at the OS level.
Exfiltrates GPS location, microphone/camera feeds, and local app data.
Use Case (The "So What?")
For SOC and Blue teams, Graphite represents a critical blind spot where network-level monitoring fails. Defense requires strict mobile device management (MDM) and rapid OS patching, as traditional phishing awareness is useless against zero-click vectors.
Availability
Commercial license (Restricted to government and law enforcement agencies).
Relevant Terms
Zero-click exploit: A cyberattack that compromises a device without requiring any interaction from the user.
Endpoint Compromise: The successful infiltration of an end-user device, allowing attackers to access data before encryption.
