‘TunnelVision’ Attack Leaves Nearly All VPNs Vulnerable to Spying

Leviathan Security researchers describe “TunnelVision”, a technique that abuses DHCP option 121 to push specific routes to a VPN client’s routing table so that VPN-protected traffic is diverted through a malicious DHCP gateway and transmitted unencrypted; Android is immune but most other OSes lack complete fixes. The report includes PoC behavior, attacker requirements (network administrative control or a rogue DHCP on the local LAN), limited mitigations (VMs with non-bridged adapters, mobile hotspots, firewall rules), and the privacy and de-anonymization risks posed by the attack.