ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - March 2, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

U.S. Military Strikes on Iran
ClawJacked: Malicious Sites Hijack Local AI Agents
Monthly Geopolitical Assessment | March 2026

U.S. Military Strikes on Iran

Source: https://www.zerofox.com/advisories/38658/

Israel began targeting Hezbollah, as both the United States and Israel escalated strikes on Iran soon after Iranian state television confirmed that Ayatollah Ali Khamenei, the Supreme Leader of Iran, was killed in Operation Epic Fury on March 1. Epic Fury is the joint U.S.-Israel military operation targeting senior regime leadership and military assets in Iran.
Following the death of Khamenei, Iran announced a new wave of missile and drone strikes on Israel, U.S. military sites, and Gulf and Arab allies in the region.
U.S. President Donald Trump said there are “some good candidates” to lead Iran, suggesting the U.S./Israeli military operation intends to dismantle and replace the existing Iranian political and military establishment.
Iran is unlikely to offer concessions in the short term.
The Iranian government can likely withstand the loss of key leaders due to decentralized political decision-making and a long succession line.
A complete overthrow of the government is unlikely from military airstrikes unless they are accompanied by domestic opposition. Therefore, the pace and breadth of military operations will likely be dictated by the opposition response.

ClawJacked: Malicious Sites Hijack Local AI Agents

Source: https://www.bleepingcomputer.com/news/security/clawjacked-attack-let-malicious-websites-hijack-openclaw-to-steal-data/

What we know: ClawJacked (CVE-2026-25253) is a high-severity vulnerability that enables attacker-controlled websites to hijack local OpenClaw AI instances through insecure localhost bindings. Users should update to version 2026.2.26 or later to protect their systems.

Context: This vulnerability stems from insecure "localhost" settings in the user’s system that allow browsers to bypass standard security blocks during a site visit. This opens a direct communication line (WebSocket) to the victim’s system. Once connected, the attacker runs malicious scripts to rapidly guess passwords without being blocked and gain full administrative control.

Analyst Note: Attackers are likely to exfiltrate sensitive information the AI agent has access to, such as private chat history and emails and misuse that for phishing, sophisticated social-engineering lures, credential theft and lateral network movement. This highlights the risk a simple website visit can pose.

Monthly Geopolitical Assessment | March 2026

Source: https://www.zerofox.com/advisories/38642/

Following the operation that killed Mexico’s top cartel leader El Mencho, retaliatory acts of cartel violence are likely to dissuade further counter-narcotics operations. Mexico’s residents are the primary victims of cartel-related crime, and deliberate targeting of Westerners is rare; however, retaliatory cartel violence in major Mexican cities will likely injure or kill innocent bystanders.
Trade uncertainty will very likely be driven by whether firms will aggressively seek tariff refunds and if U.S. authorities will impose new tariffs to counter the U.S. Supreme Court ruling that country-specific U.S. tariff rates are illegal.
Continued terror attacks in Pakistan make cross-border fighting with Afghanistan almost certain, while also increasing the probability of renewed hostilities with India.
Renewed fighting is likely in Ethiopia before elections in June 2026. Conflict in Ethiopia will likely have a wider impact due to East Africa’s complex web of alliances and rivalries.

DEEP AND DARK WEB INTELLIGENCE

Iranian apps and sites hacked amid strikes: Several Iranian websites and apps, including BadeSaba, a popular religious calendar app, were defaced to display messages urging armed forces to give up weapons and join the people. Social media users have also reported that Iranian national television channels were hijacked to broadcast videos of President Trump and Israeli Prime Minister Benjamin Netanyahu’s speeches. Hacktivist activity is also rampant with threat collectives declaring allegiance to either side of the conflict and claiming attacks on various organizations and entities. Threat collectives including Handala, ALTOUFAN team, Cyber Islamic Resistance, RipperSec, and DieNet have claimed politically motivated attacks against organizations (including critical infrastructure entities) in countries they deem to be against Iran, including critical infrastructure entities. Another threat collective, 404 CYBER CREW TEAM, has claimed to have targeted Iran’s undersea cable infrastructure. Images of passport scans, allegedly belonging to political activist Reza Pahlavi and his wife, are also being circulated. Since Iran is facing an almost total internet blackout, threat actors operating from within the borders are unlikely to be able to conduct any attacks. Moreover, entities within the Iranian borders are also unlikely to face DDoS attacks by anti-Iran threat actors. However, even if ground operations cease, these cyber operations, including Iranian state-linked ones, will likely continue for a few weeks afterwards.