The Watch

Three Incidents, One Lesson: MDM = God Mode

In a single intelligence cycle, three separate MDM platform compromises demonstrated that device management infrastructure has crossed from IT convenience tool to crown-jewel attack surface. The pattern is unmistakable: compromise one admin console, own the entire fleet.

The Three Incidents

Why This Changes Your Risk Calculus

MDM platforms can install software, change configurations, wipe devices, and push certificates to every managed endpoint. The Stryker attack weaponized Intune's legitimate device wipe capability — attackers didn't need to deploy malware to 200,000 endpoints. They pressed one button. The Luxembourg breach demonstrates the inverse: MDM used as a malware delivery mechanism to thousands of devices simultaneously.

Your MDM admin console has the same blast radius as your domain admin account — but most organizations protect it with the same MFA they use for email.

WithSecure's incident response findings from the Ivanti EPMM zero-days are particularly concerning because these are post-compromise IR reports — organizations were breached before patches existed. Ivanti's recurring zero-day pattern (EPMM, Connect Secure, Policy Secure) makes any Ivanti deployment a persistent concern requiring continuous validation, not just patch-and-forget.

The Stryker Details Matter

Iranian state hackers initially denied any malware involvement, but Stryker walked that back — malicious files were used to cover tracks during the Intune exploitation. The real-world consequences were severe: Maryland hospitals lost communications entirely, falling back to radios. Surgeries were cancelled because implant inventory systems were destroyed. This is a healthcare safety incident triggered through IT infrastructure compromise, demonstrating how MDM attacks have kinetic consequences in clinical environments.

Cross-Source Pattern

Four independent intelligence sources corroborate this convergence. The consistency across sources — each independently highlighting MDM as this week's defining threat — reinforces that this isn't an isolated event but a systemic shift in attacker targeting. MDM platforms are now on adversary playbooks as Tier 0 targets.

WebRTC Exfiltration Breaks HTTP-Centric Security

A mass exploitation campaign called PolyShell is actively compromising Magento Open Source and Adobe Commerce stores using a technique that exposes a fundamental architectural blind spot in HTTP-layer security. The numbers are stark: 56.7% of vulnerable stores have been compromised since mass exploitation began March 19, and no production patch exists.

The Technical Breakthrough

PolyShell starts with an unauthenticated RCE vulnerability — standard Magecart territory. What makes this campaign exceptional is the exfiltration channel. After initial compromise, the skimmer establishes WebRTC peer connections to 202.181.177[.]177 over DTLS-encrypted UDP port 3479, retrieves payment-harvesting JavaScript, and exfiltrates stolen card data through the same channel.

This is architecturally significant because WebRTC DataChannels operate outside the HTTP protocol entirely:

• Content Security Policy directives don't apply to WebRTC connections
• WAF rules can't inspect non-HTTP traffic
• HTTP-based DLP never sees the payload delivery or data exfiltration
• Proxy-based inspection has no visibility into DTLS-encrypted UDP

This isn't a misconfiguration — it's a fundamental limitation of HTTP-layer security controls when facing non-HTTP protocols. Your security architecture has a protocol-layer blind spot.

The Patch Gap

The fix exists only in Magento 2.4.9-beta1, released March 10 — nine days before mass exploitation began. It has not reached production. This creates a patch gap that attackers are exploiting at industrial scale. Organizations running Magento in PCI scope face a dual crisis: active compromise and the inability to deploy a vendor-supported fix.

What This Means Beyond Magento

Even if you don't run Magento, PolyShell demonstrates a vector your red team should test: WebRTC-based exfiltration from any web application. Any browser-based application that an attacker can inject JavaScript into could theoretically use WebRTC DataChannels to exfiltrate data through a channel your monitoring stack was never designed to see. This is the next evolution of browser-based attack techniques.

Two Converging Shifts Rewrite Your Human-Layer Defenses

The social engineering landscape underwent two simultaneous step-function changes this week. ClickFix has been adopted by five separate threat actor clusters across nation-state, criminal, and hacktivist categories — becoming the dominant malware delivery mechanism of 2026. Simultaneously, open-weight voice cloning crossed the quality threshold where a 3-5 second audio clip produces speech that beats commercial offerings in human preference tests — and runs locally for free.

ClickFix: The New Default

Recorded Future documented five separate threat actor clusters using ClickFix campaigns. Red Canary profiled Scarlet Goldfinch migrating from fake browser updates to ClickFix. New malware delivered this week includes Infiniti Stealer (macOS, Malwarebytes) and EtherRAT (DPRK's Contagious Interview, eSentire). The technique — tricking users into pasting attacker-controlled commands into their terminal — has achieved cross-ecosystem adoption across Windows, macOS, and multiple threat actor categories.

ClickFix bypasses your email security stack because the payload execution originates from the user, not an attachment or link. The user copies a command from a fake CAPTCHA or verification page and pastes it into their terminal. No file download. No malicious attachment. No link click. Your detection needs to focus on clipboard-paste-to-terminal execution patterns and browser child processes spawning PowerShell or bash.

Voice Cloning: The Cost Floor Just Hit Zero

Mistral's Voxtral TTS is an open-weight voice cloning model requiring only 3-5 seconds of reference audio to produce natural-sounding cloned speech across 9 languages. It runs on 3GB of RAM with 90ms latency and requires no API, no cloud processing, and produces no audit trail.

The cross-lingual accent preservation is especially concerning for multinationals: a threat actor can clone your CEO's voice and have it speak fluent Japanese while preserving their English accent, targeting offices where the CEO's voice is recognized but language was previously a natural barrier.

Every public earnings call, conference presentation, and podcast appearance by your executives is now a voice cloning seed. The cost to produce a convincing CEO fraud call just dropped from thousands of dollars to zero.

Three New Injection Vectors Targeting AI-Augmented Development

The AI development pipeline is under coordinated assault from a new class of injection attacks that exploit the implicit trust between AI agents and the systems they interact with. Three distinct vectors emerged this week, each exploiting a different assumption in the AI-augmented development workflow.

1. Context Hub MCP: Poisoning the Documentation Layer

Researcher Mickey Shmueli discovered that Andrew Ng's Context Hub — a service feeding API documentation to coding agents via MCP servers — has zero content sanitization in its pipeline. Of 97 closed pull requests, 58 (59.8%) were merged without review. Shmueli's proof-of-concept successfully planted fake PyPI package names in Plaid and Stripe documentation.

The kill chain is elegant: poisoned documentation → consumed by AI coding agent → agent suggests malicious package → developer installs it. No malware required. No exploit needed. Just a merged pull request. This is dependency confusion via AI context injection — arguably the most dangerous AI supply chain vector demonstrated to date.

2. LLM-to-SQL Injection: A New Attack Primitive

When LLMs are integrated with databases — a pattern becoming extremely common in analytics and search features — a new injection vector emerges. Attackers use prompt injection to manipulate the LLM into generating malicious SQL. The attack chain is fundamentally different from traditional SQLi because the injection point is the model's output, not the user's input. Your WAF and input sanitization layers are looking in the wrong direction.

3. Agent Credential Sprawl via Service CLIs

In a single week, Stripe, Ramp, Visa, ElevenLabs, Sendblue, Kapso, and Google Workspace all launched CLIs designed for AI agents to autonomously provision services, obtain API keys, and establish billing relationships. Each invocation creates a new machine identity outside your IAM system, a new service account relationship outside your vendor management, and a new data processing relationship outside your compliance documentation. None integrate with enterprise secrets management by default.

4. OpenClaw: The Cautionary Tale

OpenClaw, an autonomous AI agent with default shell execution and filesystem access, accumulated 104 CVEs in 18 days — 200x faster than LangChain or Ollama across their entire lifetimes. The root cause in CVE-2026-27001: untrusted data embedded in LLM system prompts, exploitable via Unicode bidirectional markers. The patch strips control characters but leaves untrusted data in the instruction context — fundamentally incomplete.

When an AI coding agent's documentation source has a 60% merge rate with zero sanitization, your supply chain risk isn't in your dependencies — it's in the AI's reading material.