A new class of Wi-Fi attack named AirSnitch was disclosed at NDSS Symposium 2026 by a joint team from UC Riverside and KU Leuven's DistriNet lab. Instead of breaking WPA2 or WPA3 encryption, AirSnitch targets the structural gap between Layer 1, Layer 2, and Layer 3 of Wi-Fi networks, where no cryptographic binding exists. This allows attackers to bypass client isolation — the core defense that prevents devices on the same network from directly communicating with each other.
Three Techniques, One Goal: Full Bidirectional MitM
The attack combines three methods: MAC address spoofing (Downlink hijack) — impersonating a victim's MAC to redirect downstream traffic from the access point; port stealing — associating the victim's MAC with a different BSSID to force the AP's internal switching logic to re-map the port; and gateway impersonation (Uplink hijack) — masquerading as the internal gateway to intercept outbound traffic. Together they grant the attacker complete control over all data flowing to and from the victim device.
Nearly Every Router Tested Is Vulnerable
The researchers tested a wide range of consumer and enterprise equipment: Netgear Nighthawk x6 R8000, Tenda RX2 Pro, D-LINK DIR-3040, TP-Link Archer AXE75, Asus RT-AX57, as well as open-source firmware DD-WRT v3.0-r44715 and OpenWrt 24.10. All were successfully compromised. The attack was also replicated inside two university enterprise networks, confirming it is a protocol-level flaw, not a vendor-specific bug.
HTTPS Offers Limited Protection
For unencrypted traffic — common in internal enterprise networks using HTTP — attackers can read passwords, authentication cookies, and payment card data in cleartext, and even modify content in real time. For HTTPS traffic, although the payload remains encrypted, attackers can still harvest DNS queries to learn visited domains, infer URLs from external IP addresses, and launch DNS cache poisoning combined with SSL stripping to trick users into surrendering credentials on seemingly secure pages. Public Wi-Fi hotspots in cafes, hotels, and airports are especially dangerous.