A spear-phishing campaign against finance staff at city hall installs a malicious wireless profile that prefers an attacker-controlled SSID. How does this social-engineering outcome enable further WLAN compromise?
Select an answer to reveal the explanation.
Short Explanation
The phish did not smash the AP—it rewrote the laptop’s little black book of trusted Wi-Fi names. Next time the staff machine sees the attacker SSID, it walks right over for a MITM chat. Fix the profile and the people process, not just the radio firmware.
Full Explanation
A spear-phishing campaign against finance staff at city hall that installs a malicious wireless profile preferring an attacker-controlled SSID enables further WLAN compromise by altering client wireless trust so devices auto-join an attacker SSID, enabling follow-on MITM. The social-engineering outcome changes preferred-network behavior, after which encryption to the real enterprise SSID no longer protects the session because the client joined the wrong network. It does not permanently disable all radios via regulatory domain locks. It does not convert every AP into a spectrum-only sensor with no client service. It does not force WPA3-Enterprise 192-bit mode that cannot be downgraded. Finance staff with privileged application access are high-value targets for profile-based wireless redirection in municipal environments. Exam caveat: endpoint wireless profile integrity and user awareness are part of WLAN defense-in-depth, alongside WIPS and 802.1X. Operational check: hunt endpoints for unauthorized preferred wireless profiles, reset profiles via MDM, require re-enrollment to known-good enterprise settings, reset any credentials entered while on the attacker SSID, and add malicious-profile examples to finance phishing awareness.