Digital shields failing against Wi-Fi attacks and AI infostealers.

Daily Cybersecurity News - March 9, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 9, 2026 6:10 PM 5 min read

Wi-Fi Attack Bypasses Client Isolation

Executive Summary

A new set of attacks, collectively named AirSnitch, bypasses Wi-Fi client isolation features, allowing an attacker already on the network to intercept traffic and perform machine-in-the-middle (MitM) attacks. This vulnerability, which does not have a single CVE identifier, affects both home and enterprise networks by exploiting weaknesses in how client identity is managed across network layers.

Vulnerability Details

Affected Product: Potentially all Wi-Fi networks (home and enterprise) with client/AP isolation enabled; every router and network tested by the researchers was vulnerable to at least one attack vector.
Identifier: No single CVE has been assigned as this is considered a fundamental design weakness.
Severity:High impact. No official CVE or CVSS assigned, this is a systemic architectural weakness in Wi-Fi client isolation implementations rather than a patchable flaw in any single product.
Exploitation Status: Proof-of-concept exploit code is publicly available.

Risk & Impact

Triage: Urgent. Networks relying on client isolation for security, such as public or guest Wi-Fi, are at high risk.
Attack Vector: An attacker with access to the Wi-Fi network can spoof a victim's MAC address or abuse shared network keys to intercept or inject traffic, bypassing client isolation. This can lead to machine-in-the-middle (MitM) attacks, allowing for the interception of unencrypted data.
Ease of Exploit: The attack requires the adversary to be connected to the target Wi-Fi network. The public availability of a proof-of-concept tool increases the ease of exploitation for skilled attackers.

Action Plan

Immediate Action: Apply firmware updates from hardware vendors as they become available. Encrypted traffic such as HTTPS and VPNs is not directly affected and remains a primary defense.
Workaround: For network administrators, enforce network segmentation using VLANs, enable IP and ARP spoofing prevention, and use WPA3 with Protected Management Frames (PMF). For general users, using a VPN on untrusted or public Wi-Fi networks is strongly recommended.
Detection: Deploying a wireless intrusion prevention system (WIPS) can help detect and block rogue devices. Monitor for malicious unicast IP packets embedded within broadcast Wi-Fi frames.

Relevant professional terms

Layer 1 (Physical Layer): The first and lowest layer of the OSI model, responsible for the physical connection between devices and the transmission of raw data bits over a physical medium like cables or radio waves.
Layer 2 (Data Link Layer): The second layer of the OSI model, responsible for node-to-node data transfer and managing how data is packaged into frames. It handles error detection from the physical layer and uses MAC addresses for local network addressing.

Source: Schneier on Security

Fake AI Tools Spread Infostealers

Executive Summary

Threat actors are using sponsored search results and cloned websites to distribute fake installers for the "Claude Code" AI tool. This campaign targets both Windows and Mac users, tricking them into executing malicious commands that deploy the Amatera infostealer to harvest credentials and browser data.

Key TTPs

Initial Access: Malvertising via sponsored Google search results for terms like "Claude Code install" leads users to lookalike download pages.
Execution: Users are tricked into copying and pasting malicious one-liner shell commands (such as curl piped directly to bash) into their terminal. On Windows, this often involves using the legitimate mshta[.]exe binary to fetch and run remote HTA payloads.

Campaign Analysis

This "InstallFix" technique is highly effective as it bypasses traditional email security and leverages user trust in search engines and familiar installation processes. The attack's success relies on social engineering rather than exploits, deploying infostealers like Amatera to steal session tokens and passwords for immediate misuse.

Targeting & Infrastructure

Target Profile: The campaign targets developers and other technical users on both Windows and macOS platforms who are seeking AI-powered coding tools.
Infrastructure: Attackers use lookalike domains and abuse services like Cloudflare Pages, Squarespace, and Tencent EdgeOne for hosting.

Relevant Terms

Infostealer: A type of malware designed to secretly gather sensitive information from a victim's computer, such as passwords, browser session data, and financial details.
Malvertising: The use of online advertising to spread malware. Attackers purchase ads on search engines that direct users to malicious websites hosting fake installers or scams.

Source: Malwarebytes

ClickFix Attack Abuses Windows Terminal

Executive Summary

The ClickFix social engineering technique tricks users into executing malicious PowerShell commands via the Windows Terminal or Run dialog. Attackers use fake CAPTCHA pages, browser errors, or update notifications to convince victims to copy and paste commands, bypassing conventional security solutions.

Key TTPs

Initial Access: Malvertising, phishing emails, or compromised websites redirect users to a lure page.
Execution: User is tricked into pasting a malicious command, often from their clipboard, into PowerShell or the Windows Terminal.
Defense Evasion: The attack relies on user-initiated execution to bypass automated security controls and browser protections.

Campaign Analysis

This evolving technique leverages clever social engineering to make the victim the agent of compromise. Payloads often include information stealers like Lumma Stealer and Remote Access Trojans (RATs) such as NetSupport and DarkGate.

Targeting & Infrastructure

Target Profile: Campaigns have targeted a broad range of industries globally, including transport, logistics, healthcare, and government, affecting both Windows and macOS users.

Relevant Terms

Social Engineering: A manipulation technique used to trick individuals into divulging confidential information or performing actions.
PowerShell: A command-line shell and scripting language built on .NET, used by attackers for fileless malware execution.

Source: SecurityWeek

Russian Actors Target Secure Messaging Apps

Executive Summary

According to Dutch intelligence agencies, Russian state-sponsored hackers are conducting a global campaign to compromise the Signal and WhatsApp accounts of government officials, military personnel, and journalists. The operation relies on social engineering to hijack accounts rather than exploiting technical flaws in the applications.

Key TTPs

Initial Access: Attackers use social engineering, persuading targets to divulge security verification codes and PINs. They often impersonate a Signal support chatbot to appear legitimate.
Execution: The campaign abuses legitimate application features, such as the "linked devices" function, to connect an actor-controlled device to the victim's account, granting access to all messages.

Campaign Analysis

This campaign signifies a focus on high-value human targets and their communications, bypassing traditional network defenses by attacking the user directly. By targeting end-to-end encrypted platforms, the actors aim to intercept sensitive intelligence at its source.

Targeting & Infrastructure

Target Profile: Diplomats, military staff, government officials, and journalists worldwide who are of interest to the Russian government.

Relevant Terms

Social Engineering: A manipulation technique used to trick individuals into divulging confidential information or performing specific actions.
End-to-End Encryption (E2EE): A secure communication method that prevents third parties from accessing data while it's transferred from one end system or device to another.

Source: Help Net Security