Though less well-known than groups like Volt Typhoon and Salt Typhoon, Brass Typhoon, or APT 41, is an infamous, longtime espionage actor that foreshadowed recent telecom hacks.

As China continues its digital gambit around the world, researchers are warning that hacking activity from long-tracked groups is evolving and blending together. On top of that, attackers are hiding their campaigns more effectively and blurring the lines between cybercriminals and state-backed hacking.

Last year, revelations rocked the United States federal government that the Chinese hacking group known as “Salt Typhoon” had breached at least nine major US telecoms. And the group’s rampage even continued into this year in the US and other countries around the world. Meanwhile, the Beijing-linked hacking group “Volt Typhoon” has continued to lurk in US critical infrastructure and utilities around the world. Meanwhile, the notoriously versatile syndicate known as Brass Typhoon—also called APT 41 or Barium—has been operating in the shadows.

The group, which researchers have been tracking since about 2012, has quietly continued its broad targeting around the world over the past year. Brass Typhoon has cast a wide net, leading researchers to view it as a sort of broad coalition that has attacked everything from a US livestock app to source code and chip designs from Taiwan’s semiconductor industry and even power grids. And over the last year, the group has compromised international institutions in the tech and automotive sectors, materials, shipping and logistics, media, and more, using new and refined malware in an array of sustained campaigns.

“They’re absolutely still active and still evolving,” says John Hultquist, who leads threat intelligence at the Google-owned cybersecurity firm Mandiant. “But it’s harder to attribute some of this activity than it was in the past, because it’s all part of a much bigger ecosystem of China’s activity which has been deliberately built to create a tremendous amount of capability.”

Brass Typhoon is known for having carried out a notable string of software supply chain attacks in the late 2010s and for brazen attacks on telecoms around the same time in which the group specifically targeted call record data. The gang is also known for its hybrid activity, carrying out hacks that align with Chinese state-sponsored espionage by the Chinese Ministry of State Security, but also moonlighting on seemingly cybercriminal projects, particularly focused on the video game industry and in-game currency scams.

Research indicates that Brass Typhoon has continued to be active in recent months with financial crimes targeting online gambling platforms as well as espionage targeting manufacturing and energy firms. Its sustained activity has run in parallel to Salt and Volt Typhoon’s recent, attention-grabbing campaigns, and analysis increasingly shows that China’s state-backed hacking operations must be viewed comprehensively, not just in terms of individual actors.

“I think we should not get too down the rabbit hole of is it Salt? Is it Flax? Is it Volt?” former US Cybersecurity and Infrastructure Security Agency director Jen Easterly told WIRED during her last days in that role in January, referring to an array of Beijing-linked hacking groups. “At the end of the day, China, as we've seen in assessments from the Intelligence Community, is the most formidable, persistent cyber threat that we are dealing with.”

Hultquist agrees, emphasizing that while tracking the activity of individual groups is still vital, it is increasingly important for defenders to factor in the advantages that state espionage and offensive hacking operations gain from broad collaboration.

“There was a time when there were very simple indicators that told us who each actor was, and they were operating incredibly loudly, so it was easy to spot the smash-and-grab nature of the activity,” he says. “APT 41 is still doing some loud activity, but so much of its activity now has gotten better and they’ve made an effort to really avoid our controls.”

Ultimately, though, researchers say that the most significant takeaway about Brass Typhoon’s current activity is that it continues apace.

Brass Typhoon: The Chinese Hacking Group Lurking in the Shadows

From crypto kingpins to sophisticated scammers, these are the lesser-known hacking groups that should be on your radar.

Read More

_The Last of Us_ Creator Didn’t Want to Sweep ‘Upsetting’ Moments Under the Rug

During _The Last of Us_’ second-season premiere, Ellie gets called a homophobic slur. Craig Mazin tells WIRED it highlights what happens when humanity stops moving forward.

FTC v. Meta Trial: The Future of Instagram and WhatsApp Is at Stake

The blockbuster antitrust case begins Monday. Its outcome could impact how Big Tech companies grow—but the government has a long way to go to prove its case.

The Best Laptops to Work and Play Wherever You Are

These are our favorite Windows laptops, MacBooks, Chromebooks, and Linux portables.

The Best Backpacking Water Filters

We’ve tested filter from Sawyer, Katadyn, LifeStraw, MSR and more to find the best option for every adventure.

The Best Way to Roast a Chicken Is on a Stick

This simple gadget is a fun and inexpensive way to tinker.

Small Language Models Are the New Rage, Researchers Say

Larger models can pull off a wider variety of feats, but the reduced footprint of smaller models makes them attractive tools.

Homeland Security Email Tells a US Citizen to 'Immediately' Self-Deport

An email sent by the Department of Homeland Security instructs people in the US on a temporary legal status to leave the country. But who the email actually applies to—and who actually received it—is far from clear.

The Best Google Pixel 9 Cases and Accessories

Whether you saved some cash with the Pixel 9a or went big with the Pixel 9 Pro XL, we’ve got a selection of cases—MagSafe included—to kit out your new Android phone.

Am I the Asshole if I Don’t Put My Phone on Airplane Mode?

If you don’t, your flight won’t crash, but ignoring airplane mode uses up your battery and annoys the pilot.

The 24 Best Shows on Amazon Prime Right Now

_The Wheel of Time, Reacher_, and _The Bondsman_ are just a few of the shows you should be watching on Amazon Prime Video this week.

China Secretly (and Weirdly) Admits It Hacked US Infrastructure

Plus: The Department of Homeland Security begins surveilling immigrants' social media, President Donald Trump targets former CISA director who refuted his claims of 2020 election fraud, and more.

The Most Dangerous Hackers You’ve Never Heard Of

Millions of scam text messages are sent every month. The Chinese cybercriminals behind many of them are expanding their operations—and quickly innovating.

The scam text messages follow a similar pattern: You need to pay an outstanding toll road fee, or a parcel can’t be properly delivered, they say. “The USPS package arrived at the warehouse but could not be delivered due to incomplete address information,” reads one typical message.

A link in the message points to a realistic website where you are asked to enter more details and make a small payment—while behind the scenes, cybercriminals hoover up your information and credit card digits in real time.

These messages originate from one prolific collection of loosely linked cybercriminals: “smishing” syndicates.

Over the past three years, these Chinese-speaking fraudsters have developed and operated the world’s foremost smishing operation, spamming millions of people with text messages and likely stealing millions of dollars in the process. The term “smishing” is a mashup of SMS and phishing emails, which try to trick people into handing over personal details. Text messages, though, add a layer of urgency and may catch people off-guard as they go about their busy day.

Now, these groups are quickly adapting their methods and expanding their scamming, security experts say.

“They operate very similar to a \[legitimate\] business in a lot of ways,” says Grant Smith, the founder of offensive cybersecurity firm Phantom Security who last year hacked one Chinese-language group and uncovered how its internal phishing kits function.

“The vast majority of the kits I see nowadays are surprisingly well put together,” Smith says. “They are constantly developing these, constantly updating them, making them look better, making them more secure.”

Multiple Chinese-speaking smishing groups and individual actors are involved in the ongoing development of new techniques and running the large-scale fraud. Often, groups will even sell the kits they develop to less sophisticated cybercriminals to easily operate.

Ford Merrill, a security researcher at SecAlliance, part of the CSIS Security Group, has been tracking the syndicates for two years and says there are now seven “major” Chinese “phishing-as-a-service” actors. “They have been enabling global SMS-based phishing campaigns at a massive scale since early 2023 onwards,” he tells WIRED.

Criminals will create websites impersonating companies or brands—such as postal services, tax authorities, telecoms, utilities companies, and increasingly payment providers—and then send texts (either SMS, encrypted iMessage, or RCS) that entice people to enter their personal information and bank cards on the fraudulent websites. This process requires the fraudsters to register thousands of domains and use Apple iCloud accounts.

One of the most prominent of the smishing actors is often referred to as the Smishing Triad—although security researchers group Chinese-speaking threat actors and affiliates in different ways—which has impersonated organizations and brands in at least 121 countries, according to recent research by security company Silent Push.

Around 200,000 domains have been used by the group in recent years, the research says, with around 187 top-level domains—such as .top, .world, and .vip—being used. Across one recent 20-day period, there were more than 1 million page visits to scam websites used by the Smishing Triad, according to Silent Push.

Besides collecting names, emails, addresses, and bank card details, the websites also prompt people to enter one-time passwords or authentication codes that allow the criminals to add bank cards to Apple Pay or Google Wallet, allowing them to use the cards while on the other side of the world.

“They have effectively turned the modern digital wallet, like Apple Pay or Google Wallet, into the best card-cloning device we’ve ever invented,” Merrill says.

In Telegram groups linked to the cybercriminal organizations, some members share photos and videos of bank cards being added to digital wallets on iPhones and Androids. For instance, in one video, scammers allegedly show off dozens of virtual cards that they have added to phones they are using.

Merrill says the criminals may not make payments using the cards they’ve added to digital wallets straightaway, but it probably won’t take long.

“When we first started seeing this, they would wait between 60 and 90 days before actually stealing money from the cards,” he explains, adding that at first the criminals would let the cards “age” on a device in an attempt to look legitimate. “Nowadays you would be lucky if they wait seven days or even a couple days. Once they hit the card, they hit it hard and fast.”

“Security is core to the Google Wallet experience, and we work closely with card issuers to prevent fraud,” says Google communications manager Olivia O'Brien. “For example, banks notify customers when their card has been added to a new Wallet, and we provide signals to help issuers detect fraudulent behavior so they can decide whether to approve added cards.”

Apple did not respond to WIRED’s request for comment.

The giant scam ecosystem is powered in part by commercial underground scamming services. Findings from security firm Resecurity, which has tracked the Smishing Triad for more than two years, says the group has been using “bulk” SMS and message-sending services as it has expanded the number of messages it sends.

Meanwhile, as multiple security researchers have noted, the Smishing Triad group also uses its own software, called Lighthouse, to collect, manage, and store people's personal information and card details. A video of the Lighthouse software originally shared on Telegram and republished by Silent Push shows how the system collects card details.

The latest version of the software, which was updated in March this year, “targets dozens of financial brands” including PayPal, Mastercard, Visa, and Stripe, Silent Push says. In addition, the research says, Australian banking brands appear to be impersonated, indicating a potential further expansion of targets.

The smishing groups are constantly improving their own scamming software. Smith, the researcher who hacked a smishing gang, says he has seen groups operating their own development pipelines for their software and systems.

“Recently they were using some custom-made software that they had to basically replicate Jira and have tickets open for any issues with the platform and any customer complaints,” Smith says. “They would assign them to team members.”

Chinese smishing groups do not appear to be slowing down. The cybercriminals are behind huge waves of toll road text scams sweeping across the United States this year, says Shawn Loveland, the chief operating officer at Resecurity. “They’re increasing in their scale and their volume of attacks,” he says.

Loveland says there may be multiple ways to limit the effectiveness of smishing operations. Domain registrars could get better at detecting fraudulent websites, for example, and improved spam filtering on messages would help potential victims. Plus, law enforcement could target the platforms and systems they use to create accounts and send messages.

Making it harder for smishing groups to successfully operate could reduce profits and have a cooling effect on the surging criminal ecosystem, Loveland says.

“Criminals have a supply chain, and you don't have to go after all the components in the supply chain,” he says. “You can go after choke points in the supply chain.”

Smishing Triad: The Scam Group Stealing the World’s Riches

After a series of setbacks, the notorious Black Basta ransomware gang went underground. Researchers are bracing for its probable return in a new form.

The pecking order of ransomware gangs is always shifting and evolving, with the most aggressive and reckless groups netting big payouts from vulnerable targets—but often ultimately flaming out. Russian-speaking group Black Basta is the latest example of the trend having stalled out in recent months due to takedowns by law enforcement and a damaging leak. But after some quiet weeks, researchers warn that, far from being dead and gone, the actors involved with Black Basta will reemerge in other cybercriminal groups—or potentially already have—to start the cycle once again.

Since appearing in April 2022, Black Basta has generated hundreds of millions of dollars in payments targeting an array of corporate victims in health care, critical infrastructure, and other high-stakes industries. The group uses double extortion to pressure targets into paying a ransom—stealing data and threatening to leak it while also encrypting a target’s systems to hold them hostage. The US Cybersecurity and Infrastructure Security Agency warned last year that Black Basta had gone on a spree targeting more than 500 organizations in North America, Europe, and Australia.

A major international law enforcement takedown in 2023 of the “Qakbot” botnet hindered Black Basta’s operations, though. And, this February, a major leak of the group’s internal data—including chat logs and operational information—rocked the group. Since then, it has gone dormant. Researchers warn, though, that the criminals behind Black Basta are already on the move and are almost certain to stage a resurgence.

“We haven’t seen the leaders of Black Basta regroup, but they’re going to continue to work, they’re going to continue to operate,” says Allan Liska, a threat intelligence analyst focused on ransomware at the security firm Recorded Future. “There’s still too much money in it not to. And ransomware actors are creatures of habit just like anyone.”

The leak revealed details about Black Basta’s malware and technical capabilities, its internal squabbles, and clues about the identity of the actors behind the group, particularly its main administrator. The exposed data was from what might be considered Black Basta’s heyday, September 2023 to September 2024. During this period, the group didn’t shy away from the possibility of causing harm with its breaches. A particularly aggressive attack last year on the St. Louis–based health care network Ascension, for example, reportedly caused disruptions in care, including rerouted ambulances.

Black Basta struggled to maintain its momentum, though, after the 2023 Qakbot takedown, known as Operation Duck Hunt.

“It was a huge blow to them, and they were trying to get back on their feet—use other botnets, work on a custom botnet, but that didn’t really work, and ultimately their infection rate was declining,” says Yelisey Bohuslavskiy, chief research officer of the threat-intelligence firm RedSense. “They had fewer targets and were getting into fewer networks. They were still dangerous, but there was this feeling that there was deterioration going on.”

Even in this decline, there was evidence that Black Basta was trying to mount a resurgence. In addition to exploring new malware, the gang started focusing on compromising targets through social engineering and influence campaigns, particularly spam email operations and tech support scams. But after the leak, Bohuslavskiy says, members began moving to other groups and have already been buoying their new gangs.

Like any industry, the Russian cybercriminal landscape is full of people who have worked together or competed against one another for years. Black Basta was able to establish itself so quickly because many of its members were involved with previous cybercriminal operations, including the longtime cybercriminal gang Conti. Conti is a well-known group because of another internal leak incident in 2022 that exposed its inner workings and ties to the Kremlin. After Conti’s demise, researchers tracked its members as they dispersed and started new hacking groups, including Black Basta.

While Black Basta is not unique in its tactics and methods, researchers say that the group is noteworthy for its technical skills and depth of cybercriminal experience, which allowed it to push the envelope on the approaches a ransomware group can take.

“The people behind Black Basta have been in a lot of networks and have a lot of experience,” Recorder Future’s Liska says. “They aren’t the most prolific group but I think they are one of the more dangerous groups because they are so skilled.”

February’s leaks revealed, for example, that Black Basta developed a tool for automatically infiltrating network devices like routers that had easily-guessable passwords. Automating a tool to guess passwords is not a groundbreaking capability, but it is the type of project that many ransomware groups wouldn’t think to take on themselves or have the capacity to develop in-house.

In a report last week analyzing the leaked Black Basta communications, researchers from the security firm Trustwave wrote, “The messages show how members exhibit remarkable autonomy and creativity, adapting quickly to evolving security landscapes.”

The Black Basta leak is a cache of 200,000 messages and other data apparently taken from the group’s Matrix chat server, bestflowers247.online, by user “ExploitWhispers.” The trove includes the text of the group’s communications plus time stamps, sender and recipient details, and other metadata. The identity and motivation of “ExploitWhispers” is unknown, but they claimed to have leaked the data because Black Basta had allegedly attacked Russian banks, violating the unwritten rule that cybercriminals can operate in Russia with impunity so long as they do not attack Russian organizations.

While the exposure that came with the leaks was a death knell for Black Basta as a group, it is more likely to be a setback than a permanent defeat for its members.

“We haven’t seen the leaders of Black Basta regroup, but they’re going to continue to work, they’re going to continue to operate,” Recorded Future’s Liska says. “There’s still too much money in it not to. And ransomware actors are creatures of habit just like anyone.”

RedSense’s Bohuslavskiy adds that he has already seen signs of Black Basta members cropping up in other active gangs, including “BlackSuit,” “INC,” “Lynx,” “Cactus,” and “Nokoyawa.”

“Now that Black Basta is done, a lot of the people have migrated, and there are a number of other ransomware groups that are getting infusions of Black Basta talent,” Bohuslavskiy says.

Black Basta: The Fallen Ransomware Gang That Lives On

An email sent by the Department of Homeland Security instructs people in the US on a temporary legal status to leave the country. But who the email actually applies to—and who actually received it—is far from clear.

The United States Department of Homeland Security sent an email this week informing people living in the US on a temporary legal status that their "parole" has been revoked and instructed them to leave the country "immediately." However, the email was also addressed to at least one US citizen, an immigration attorney from Massachusetts. And it remains unclear who must abide by the email's instructions—or why the apparent revocation of legal immigration status was delivered via email at all.

The email informs the recipient that “DHS is now exercising its discretion to terminate your parole,” which it says will go into effect “7 days from the date of this notice.” The email appears to be similar, if not identical, to messages received by users of CBP One, an app developed during the Biden administration that allows non-citizens from certain countries to schedule appointments at US points of entry in an effort to seek asylum. A spokesperson for US Customs and Border Protection (CBP) tells WIRED, however, that the email was sent more broadly.

“CBP has issued notices terminating parole for individuals who do not have lawful status to remain,” says CBP assistant commissioner for public affairs Hilton Beckham. “This process is not limited to CBP One users and does not currently apply to those paroled under programs such as U4U and OAW.”

U4U refers to Uniting for Ukraine, a program launched under the Biden administration to allow for expedited immigration to the US for Ukrainians fleeing Russia’s war against its neighboring country. Former President Joe Biden began OAW, or Operation Allies Welcome, in 2021 following the US military’s exit from Afghanistan to allow for the safe resettling of “vulnerable Afghans, including those who worked alongside us in Afghanistan for the past two decades,” according to DHS.

The email itself does not identify these or any other exemptions, nor does it make clear to whom it applies beyond the recipient. Beckham also confirmed that the email was sent to whatever email address the agency had associated with the intended target, leading to confusion for at least one immigration attorney.

“Some personal news: the Department of Homeland Security has given me, an immigration lawyer born in Newton, Massachusetts, seven days to leave the US,” wrote Nicole Micheroni, a partner at  Cameron Micheroni & Silvia LLC, in a post on Bluesky on Friday night. “Does anyone know if you can get Italian citizenship through great-grandparents?”

Micheroni tells WIRED that she first thought the email was intended for one of her clients, but she quickly noticed that it was only addressed to her.

“I don't feel like I'm actually going to be deported in seven days, but it's concerning that this is the level of care they're using to send these out,” Micheroni says. She adds that it’s possible that the DHS email was “intended for one of my clients or somebody else,” as it’s not uncommon for immigrants in the US to list their attorneys as the point of contact.

The Trump administration has sought to revoke the parole of some 532,000 Cubans, Haitians, Nicaraguans, and Venezuelans who entered the US under a Biden-era humanitarian parole program. While it moved to subject them to expedited deportation effective April 24, on Thursday a federal judge in Boston said she would issue a protective order blocking that attempt. However, CBP's Beckham says people covered by the order did not receive the email, which stipulates that it does not apply to people who “have otherwise obtained a lawful basis to remain” in the US.

“Thursday’s order pertains to the CHNV program, a categorical parole that was not sent termination notices,” Beckham says. “Aliens from those countries who did not enter through the CHNV program may have been subject to the termination notices.”

Attorney Lauren Regan, founder and executive director of the nonprofit Civil Liberties Defense Center, tells WIRED that the lack of clarity about whether the revocation of temporary parole applies to the recipient of the email is likely causing fear and confusion among many immigrants, especially those without access to adequate legal guidance.

“So many people don’t have a lawyer, or their lawyer has 6,000 clients,” Regan says, which “completely overloads” the attorneys who often provide pro bono legal services to immigrants.

“A lot of people that are here on parole status don't know the nuances of immigration law, so they get this email and they don't know if it applies to them,” Micheroni says. “And most of them assume that it does because everything is really scary for people right now.”

It’s also unclear whether the email is related to recent efforts by Elon Musk’s so-called Department of Government Efficiency (DOGE). In an April 10 post on X, DOGE claimed that “CBP identified a subset of 6.3k individuals paroled into the United States since 2023 on the FBI's Terrorist Screening Center watchlist or with criminal records. These paroles have since been terminated with immediate effect.”

Beckham did not immediately respond to questions about whether the email was intended for these 6,300 individuals, nor did she answer WIRED’s questions about how many people received the email.

Then there’s the matter of the email being an email at all. Regan says that “it is absolutely not common” for a change in legal immigration status to arrive via email, which typically happens in person or via certified mail. “People would think it’s a phishing email or something not legitimate,” Regan says. Also, the fact that the email does not appear to have been first posted on a government website added to questions about its authenticity.

“Normally if the government is going to change a practice, they would first do it on their websites,” Regan says, adding, “but the fact that this was not on the website first and then sent out as a direct communication is very, very unusual.”

Regan also notes that many immigrants do not have email addresses, and therefore couldn’t receive the communication in the first place.

Even for Micheroni, a US citizen and immigration attorney, the Trump administration’s aggressive immigration enforcement practices have made life less stable. The email only made matters worse.

“I have gotten some serious inquiries from my parents or other family members or friends being like, ‘what do I do if you stop answering me or if you disappear? Like, who do you want me to call?’” she says.

“And if people in my life are feeling this way, and this is what I do, I know a lot about it,” Micheroni adds. “I can't imagine what it's like for people that don't fully understand immigration law.”

_Updated at 4 pm ET: Added additional comment from CBP clarifying that Cubans, Haitians, Nicaraguans, and Venezuelans who entered the US under the so-called CHNV program did not receive the email._

Homeland Security Email Tells a US Citizen to 'Immediately' Self-Deport

Plus: The Department of Homeland Security begins surveilling immigrants' social media, President Donald Trump targets former CISA director who refuted his claims of 2020 election fraud, and more.

The Israeli spyware maker NSO Group has been on the US Department of Commerce “blacklist” since 2021 over its business of selling targeted hacking tools. But a WIRED investigation has found that the company now appears to be working to stage a comeback in Trump's America, hiring a lobbying firm with the ties to the administration to make its case.

As the White House continues its massive gutting of the United States federal government, remote and hybrid workers have been forced back to the office in a poorly coordinated effort that has left critical employees without necessary resources—even reliable Wi-Fi. And Elon Musk’s so-called Department of Government Efficiency (DOGE) held a “hackathon” in Washington, DC, this week to work on developing a “mega API” that could act as a bridge between software systems for accessing and sharing IRS data more easily.

Meanwhile, new research this week indicates that misconfigured sexual fantasy-focused AI chatbots are leaking users' chats on the open internet—revealing explicit prompts and conversations that in some cases include descriptions of child sexual abuse.

And there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

In a secret December meeting between the US and China, Beijing officials claimed credit for a broad hacking campaign that has compromised US infrastructure and alarmed American officials, according to Wall Street Journal sources. Tensions between the two countries have escalated sharply in recent weeks, because of President Donald Trump's trade war.

In public and private meetings, Chinese officials are typically firm in their denials about any and all accusations of offensive hacking. This makes it all the more unusual that the Chinese delegation specifically confirmed that years of attacks on US water utilities, ports, and other targets are the result of the US's policy support of Taiwan. Security researchers refer to the collective activity as having been perpetrated by the actor “Volt Typhoon.”

Meanwhile, the National Counterintelligence and Security Center, along with the FBI and Pentagon’s counterintelligence service, issued an alert this week that China’s intelligence services have been working to recruit current and former US federal employees by posing as private organizations like consulting firms and think tanks to establish connections.

**DHS Is Now Monitoring Immigrants’ Social Media for Antisemitism**

US Citizenship and Immigration Services said on Wednesday that it is starting to monitor immigrants' social media activity for signs of antisemitic activity and “physical harassment of Jewish individuals.” The agency, which operates under the Department of Homeland Security, said that such behavior would be grounds for “denying immigration benefit requests.” The new policy applies to people applying for permanent residence in the US as well as students and other affiliates of “educational institutions linked to antisemitic activity.” The move comes as Immigration and Customs Enforcement has made controversial arrests of pro-Palestinian student activists, including Mahmoud Khalil of Columbia University and Rumeysa Ozturk of Tufts University, over alleged antisemitic activity. Their lawyers deny the allegations.

**Trump Revokes Security Clearance, Orders Investigation of Ex-CISA Director**

President Trump this week ordered a federal investigation into former US Cybersecurity and Infrastructure Security Agency director Chris Krebs. An executive order on Wednesday revoked Krebs’ security clearance and also directed the Department of Homeland Security and the US attorney general to conduct the review. Krebs was fired by Trump in November 2020 during his first term after Krebs publicly refuted Trump’s claims of election fraud during that year's presidential election. The executive order alleges that by debunking false claims about the election while in office, Krebs violated the First Amendment's prohibition on government interference in freedom of expression.

In addition to removing Krebs' clearance, the order also revokes the clearances of anyone who works at Krebs' current employer, the security firm SentinelOne. The company said this week in a statement that it “will actively cooperate in any review of security clearances held by any of our personnel” and emphasized that the order will not result in significant operational disruption, because the company only has a handful of employees with clearances.

**NSA, Cyber Command Officials Cancel RSA Security Conference Appearances**

NSA Cybersecurity Division Director Dave Luber and Cyber Command Executive Director Morgan Adamski will no longer speak at the prominent RSA security conference, scheduled to begin on April 28 in San Francisco. Both appeared at the conference last year. A source told Nextgov/FCW that the cancellations were the result of agency restrictions on nonessential travel. RSA typically features top US national security and cybersecurity officials alongside industry players and researchers. President Trump recently fired General Timothy Haugh, who led both the NSA and US Cyber Command.

China Secretly (and Weirdly) Admits It Hacked US Infrastructure

Some misconfigured AI chatbots are pushing people’s chats to the open web—revealing sexual prompts and conversations that include descriptions of child sexual abuse.

Several AI chatbots designed for fantasy and sexual role-playing conversations are leaking user prompts to the web in almost real time, new research seen by WIRED shows. Some of the leaked data shows people creating conversations detailing child sexual abuse, according to the research.

Conversations with generative AI chatbots are near instantaneous—you type a prompt and the AI responds. If the systems are configured improperly, however, this can lead to chats being exposed. In March, researchers at the security firm UpGuard discovered around 400 exposed AI systems while scanning the web looking for misconfigurations. Of these, 117 IP addresses are leaking prompts. The vast majority of these appeared to be test setups, while others contained generic prompts relating to educational quizzes or nonsensitive information, says Greg Pollock, director of research and insights at UpGuard. “There were a handful that stood out as very different from the others,” Pollock says.

Three of these were running-role playing scenarios where people can talk to a variety of predefined AI “characters”—for instance, one personality called Neva is described as a 21-year-old woman who lives in a college dorm room with three other women and is “shy and often looks sad.” Two of the role-playing setups were overtly sexual. “It’s basically all being used for some sort of sexually explicit role play,” Pollock says of the exposed prompts. “Some of the scenarios involve sex with children.”

Over a period of 24 hours, UpGuard collected prompts exposed by the AI systems to analyze the data and try to pin down the source of the leak. Pollock says the company collected new data every minute, amassing around 1,000 leaked prompts, including those in English, Russia, French, German, and Spanish.

It was not possible to identify which websites or services are leaking the data, Pollock says, adding it is likely from small instances of AI models being used, possibly by individuals rather than companies. No usernames or personal information of people sending prompts were included in the data, Pollock says.

Across the 952 messages gathered by UpGuard—likely just a glimpse of how the models are being used—there were 108 narratives or role-play scenarios, UpGuard’s research says. Five of these scenarios involved children, Pollock adds, including those as young as 7.

“LLMs are being used to mass-produce and then lower the barrier to entry to interacting with fantasies of child sexual abuse,” Pollock says. “There's clearly absolutely no regulation happening for this, and it seems to be a huge mismatch between the realities of how this technology is being used very actively and what the regulation would be targeted at.”

WIRED last week reported that a South Korea–based image generator was being used to create AI-generated child abuse and exposed thousands of images in an open database. The company behind the website shut the generator down after being approached by WIRED. Child-protection groups around the world say AI-generated child sexual abuse material, which is illegal in many countries, is growing quickly and making it harder to do their jobs. The UK’s anti-child-abuse charity has also called for new laws against generative AI chatbots that “simulate the offence of sexual communication with a child.”

All of the 400 exposed AI systems found by UpGuard have one thing in common: They use the open source AI framework called llama.cpp. This software allows people to relatively easily deploy open source AI models on their own systems or servers. However, if it is not set up properly, it can inadvertently expose prompts that are being sent. As companies and organizations of all sizes deploy AI, properly configuring the systems and infrastructure being used is crucial to prevent leaks.

Rapid improvements to generative AI over the past three years have led to an explosion in AI companions and systems that appear more “human.” For instance, Meta has experimented with AI characters that people can chat with on WhatsApp, Instagram, and Messenger. Generally, companion websites and apps allow people to have free-flowing conversations with AI characters—portraying characters with customizable personalities or as public figures such as celebrities.

People have found friendship and support from their conversations with AI—and not all of them encourage romantic or sexual scenarios. Perhaps unsurprisingly, though, people have fallen in love with their AI characters, and dozens of AI girlfriend and boyfriend services have popped up in recent years.

Claire Boine, a postdoctoral research fellow at the Washington University School of Law and affiliate of the Cordell Institute, says millions of people, including adults and adolescents, are using general AI companion apps. “We do know that many people develop some emotional bond with the chatbots,” says Boine, who has published research on the subject. “People being emotionally bonded with their AI companions, for instance, make them more likely to disclose personal or intimate information.”

However, Boine says, there is often a power imbalance in becoming emotionally attached to an AI created by a corporate entity. “Sometimes people engage with those chats in the first place to develop that type of relationship,” Boine says. “But then I feel like once they've developed it, they can't really opt out that easily.”

As the AI companion industry has grown, some of these services lack content moderation and other controls. Character AI, which is backed by Google, is being sued after a teenager from Florida died by suicide after allegedly becoming obsessed with one of its chatbots. (Character AI has increased its safety tools over time.) Separately, users of the generative AI tool Replika were upended when the company made changes to its personalities.

Aside from individual companions, there are also role-playing and fantasy companion services—each with thousands of personas people can speak with—that place the user as a character in a scenario. Some of these can be highly sexualized and provide NSFW chats. They can use anime characters, some of which appear young, with some sites claiming they allow “uncensored” conversations.

“We stress test these things and continue to be very surprised by what these platforms are allowed to say and do with seemingly no regulation or limitation,” says Adam Dodge, the founder of Endtab (Ending Technology-Enabled Abuse). “This is not even remotely on people’s radar yet.” Dodge says these technologies are opening up a new era of online pornography, which can in turn introduce new societal problems as the technology continues to mature and improve. “Passive users are now active participants with unprecedented control over the digital bodies and likenesses of women and girls,” he says of some sites.

While UpGuard’s Pollock could not directly connect the leaked data from the role-playing chats to a single website, he did see signs that indicated character names or scenarios could have been uploaded to multiple companion websites that allow user input. Data seen by WIRED shows that the scenarios and characters in the leaked prompts are hundreds of words long, detailed, and complex.

“This is a never-ending, text-based role-play conversation between Josh and the described characters,” one of the system prompts says. It adds that all the characters are over 18 and that, in addition to “Josh,” there are two sisters who live next door to the character. The characters’ personalities, bodies, and sexual preferences are described in the prompt. The characters should “react naturally based on their personality, relationships, and the scene” while providing “engaging responses” and “maintain a slow-burn approach during intimate moments,” the prompt says.

“When you go to those sites, there are hundreds of thousands of these characters, most of which involve pretty intense sexual situations,” Pollock says, adding the text based communication mimics online and messaging group chats. “You can write whatever sexual scenarios you want, but this is truly a new thing where you have the appearance of interacting with them in almost exactly the same way you interact with a lot of people.” In other words, they’re designed to be engaging and to encourage more conversation.

That can lead to situations where people may overshare and create risks. “If people are disclosing things they’ve never told anyone to these platforms and it leaks, that is the Everest of privacy violations,” Dodge says. “That’s an order of magnitude we've never seen before and would make really good leverage to sextort someone.”

Sex-Fantasy Chatbots Are Leaking a Constant Stream of Explicit Messages

The Israeli spyware maker, still on the US Commerce Department’s “blacklist,” has hired a new lobbying firm with direct ties to the Trump administration, a WIRED investigation has found.

Shortly after Donald Trump declared victory in November, NSO Group cofounder and majority owner Omri Lavie rushed to X to congratulate him, speaking of a “new chapter where the world goes back to common sense,” while accusing the outgoing Biden administration of being “weak.” In another tweet, he gushed in Hebrew that Republicans “won in every category: the presidency, Congress, Senate, and the popular vote.”

Lavie’s enthusiasm is understandable. His company—frequently associated with alleged human rights abuses, most recently in February when journalists in Serbia were targeted with its Pegasus spyware—had a significant stake in a Trump victory, with the hopes of regaining the ability to freely do business with US entities. In a comment to Amnesty International, NSO stated, in part, that its “commitment to maintain the highest standard of ethical conduct as well as confidentiality towards our customers is paramount and is consistent with industry norms and our legal obligations.”

The Israeli spyware vendor has been on the US Commerce Department’s “blacklist” for more than three years, meaning it cannot do business with US companies without specific government approval. NSO Group poured at least $1.8 million into an aggressive pre-election lobbying effort, focusing primarily on Republican senators and representatives, with some meetings occurring as often as eight times. Yet the company remains on the Entity List.

Now, with a new occupant in the White House, NSO Group appears to be shifting its political strategy.

The company seems to have either terminated or altered its engagement with several of its previous lobbying consultancies in Washington—some of which were closely aligned with the Democrats—and has started working with a key new lobbying partner: the Vogel Group.

Founded by Alex Vogel, who served as chief counsel to former Senate majority leader Bill Frist, the Vogel Group is providing NSO Group with “strategic advisory on cybersecurity policy matters,” according to lobbying disclosure documents filed on March 10.

The Vogel Group’s connection to the Trump administration includes areas of key interest to NSO Group. One of the Israeli spyware vendor’s new lobbyists, Jonathan Fahey, joined Vogel’s Washington, DC, office as a principal on January 29 and served in various roles during Trump's first term, including acting director and acting principal legal adviser at Immigration and Customs Enforcement, deputy assistant secretary at the Department of Homeland Security, and general counsel to the White House Office of National Drug Control Policy—all three relevant departments for a company selling surveillance technology.

Another Vogel Group staffer, Hayden Jewett, is listed in disclosure records as assigned to lobby on behalf of NSO group. Jewett served as a congressional staff liaison to President Trump’s 2016 inauguration, facilitating coordination between congressional offices and the inaugural committee.

Law firm Holtzman Vogel—of which Alex Vogel is a partner—was founded by his wife, Jill Holtzman Vogel, a former Virginia state senator, a former chief counsel of the Republican National Committee (RNC), and a current principal at the Vogel Group. The firm has reportedly worked for the National Republican Senatorial Committee and the National Republican Congressional Committee and received in 2024 over $9.3 million in reported payments, with significant political funding from Republican organizations.

Holtzman Vogel also represented former Metropolitan Police Department lieutenant Andrew Zabavsky, who was pardoned by Trump in January 2025 for his conviction for obstruction of justice related to the investigation into the death of 20-year-old Karon Hylton-Brown, a case that sparked protests ahead of the 2020 US election.

Bill McGinley, a principal at the Vogel Group and former assistant to the president and cabinet secretary during Trump’s first term, left the lobbying firm after Trump appointed him to White House counsel on November 12. He was then reassigned as counsel to the so-called Department of Government Efficiency (DOGE) on December 4, only to leave on January 23.

“Lobbyists and advisers who have passed through the revolving door, having worked in the previous Trump White House or for the campaign, as well as those who are big campaign donors have a unique ability to bend the ear of the new administration,” says Dan Auble, a senior researcher at the nonprofit OpenSecrets, which tracks US political spending. “That access is very valuable.”

NSO Group spokesperson Gil Lainer declined to comment on the scope of the contract with the Vogel Group when asked by WIRED. The Vogel Group did not respond to WIRED’s request for comment.

**Closing the Circle**

NSO Group’s recent lobbying efforts appear to have mainly focused on Republican lawmakers, more than executive branch power players, particularly as the Biden administration had been engaged in a crackdown on commercial spyware. The company previously worked with several lobbying contractors, with whom it appears to have either terminated or altered its registrations.

These include its registrations under Foreign Agents Registration Act (FARA) with Pillsbury Winthrop Shaw Pittman LLP and Chartwell Strategy Group, as well as registrations under the Lobbying Disclosure Act (LDA) with law firms Paul Hastings LLP and Steptoe LLP. Pillsbury previously engaged Chartwell Strategy Group to provide NSO Group with “strategic communications counsel.” Chartwell Strategy Group has now, for the first time, registered under the LDA as a lobbyist for NSO Group, while the only current active registration of NSO Group under FARA is with Paul Hastings LLP.

Lobbyists representing foreign commercial interests—if their work is not intended to benefit a foreign government or political party—can be exempt from FARA and instead register under the LDA, which has no requirement to report specific meetings and is, overall, far less transparent than FARA.

Much of the public knowledge about NSO Group’s lobbying efforts came from FARA filings. Since both the Vogel Group and Chartwell Strategy Group are now registered under the LDA, it will now be more difficult to monitor their lobbying efforts.

Examining NSO Group's past and present consultants reveals numerous individuals who, one way or another, have been associated with the Trump administration. These people are not all lobbyists, but they do have direct connections to Trump world. They include David Tamasi, managing director at Chartwell Strategy and DC chairman of Trump’s 2016 joint fundraising committee, who bundled more than $500,000 for Trump’s campaign and the RNC in 2020, and at least $15,000 in 2024. His firm, a key player in NSO Group’s lobbying, had been actively preparing clients for Trump’s return.

Other NSO-connected figures also have close Trump ties: Bryan Lanza, a partner at Mercury Public Affairs, which consulted for the company from 2020 to 2021, is a veteran Trump ally; Michael Flynn, Trump’s former national security adviser, was paid nearly $100,000 by NSO Group’s parent firms, according to the The Washington Post, and was recently appointed by Trump to a West Point advisory board; Jeff Miller, who raised millions for Trump, received $170,000 from an NSO-linked company and was spotted at Trump’s 2024 election night event at Mar-a-Lago; and Rod Rosenstein, Trump’s former deputy attorney general, represented NSO Group in a lawsuit and previously helped justify Trump’s firing of FBI director James Comey.

Pillsbury Winthrop Shaw Pittman LLP, Chartwell Strategy Group, Paul Hastings LLP, and Steptoe LLP did not reply to WIRED’s request for comment. Nor did Flynn, Miller, or Rosenstein. Tamasi did not respond in time for publication.

**What Counts as a Win**

As of early March—before Vogel Group’s registration as a lobbyist for NSO Group—there had been no indication that the Trump administration intended to remove the company from the Entity List, according to a source familiar with the administration’s moves regarding spyware, who asked not to be named in order to discuss confidential matters. However, recent comments by NSO Group’s Lavie soft-peddled the impact of the Entity List on the company’s ability to operate in the US.

“\[The Americans\], when they say ‘blacklist,’ it sounds much more dramatic to me than it actually is,” Lavie claimed during an interview in Hebrew on an Israeli podcast following Trump’s election. He added: “You can still do business in the United States; it is definitely not a barrier for us to sell in the US.”

“In practice, we are on the list of Commerce, and what this does for us from a regulatory perspective, it simply forces American companies—if we want to buy technology from them—to ask for permission to sell us the technology. That's all,” Lavie said.

​​Lobbying efforts can target different parts of the US government. By lobbying the executive branch (the president and agencies), lobbyists can influence how laws are enforced rather than what the laws say. In contrast, when lobbying Congress, the focus is on passing, blocking, or amending laws by influencing legislators.

For example, for a company to be removed from the Entity List, it must go through a lengthy administrative process that includes a review by an interagency committee composed of representatives from the departments of Commerce, State, and Defense, among others. Although Congress could theoretically influence this process, it is not directly involved.

During the presidential transition period, NSO Group mainly focused on Congress and reached out to at least 10 Republican senators, representatives, and their staff, before beginning its outreach with the incoming administration. On February 2, the company shared its annual transparency report with Trump’s new deputy national security adviser, Alex Wong.

The Vogel Group could play a key role in supporting NSO Group if it attempts to engage with the new executive branch, including the president’s executive office, the National Security Council, and the State, Justice, and Commerce Departments, among other relevant agencies. Such engagement might aim not only at addressing NSO Group’s placement on the Entity List, but also at challenging the spyware-related visa restrictions imposed by the previous administration. In addition, the firm could potentially assist in efforts to roll back Executive Order 14093, signed by President Joe Biden, which continues to restrict the US government’s use of commercial spyware.

Asked whether the Trump administration intends to uphold the EO, White House press secretary Karoline Leavitt declined to comment.

“Much is at stake if the US revokes Executive Order 14093, an order that sets standards on US acquisition of spyware, as access to the US market, and US purchasing power, are great tools in shaping the global scope and scale of the market for spyware,” says Jen Roberts, the Atlantic Council’s associate director of the Cyber Statecraft Initiative and coauthor of a recent major report on the commercial spyware industry. Roberts also highlighted the need to better regulate US outbound investment into such technologies.

**Watching for Signs**

During Trump's first term, the FBI secretly acquired the Pegasus spyware for limited testing in 2019 and seriously contemplated its operational deployment; while during the final months of the administration in 2020, the US initiated a deal that financed the purchase of the Israeli spyware for Colombian security forces, according to the Colombian ambassador to the US and reported by Drop Site News. (The deal was finalized in 2021, after Trump left office.) In an official statement, NSO Group confirmed its dealings with Colombia but denied claims that the software was purchased irregularly. The New York Times also reported that in 2018 the CIA had purchased Pegasus for the government of Djibouti to conduct counterterrorism operations, while the Secret Service held discussions with NSO Group the same year.

The access and influence NSO Group could attain through lobbying efforts by companies like the Vogel Group and Chartwell Strategy Group could lead to a more favorable political environment and, in turn, potentially increase business opportunities under a second Trump administration—something very hard for outsiders to measure, given the opaque nature of government procurement of surveillance technologies.

In the coming weeks and months, NSO Group’s interactions with US government officials, facilitated by its lobbying, will be critical in achieving such a favorable political environment. Caroline Glick, an adviser to Israeli prime minister Benjamin Netanyahu, has also been recently lobbying the Trump White House—among others—on the matter of “request\[ing\] to check for options for lifting sanctions on Israeli technology companies,” according to reports in the Israeli media.

Experts closely monitoring the commercial spyware industry are raising the alarm about the prospect of NSO Group regaining business under Trump—further exacerbated by new reports that the company has been simultaneously pushing its interests on the international stage through the so-called Pall Mall Process, a UK- and France-led initiative to regulate such technologies.

“NSO has become a toxic brand that is widely associated not just with human rights abuses but also with national security threats to US, UK, France, and other countries,” says Natalia Krapiva, senior tech-legal counsel at civil-liberties-focused nonprofit Access Now.

Lainer, the NSO Group spokesperson, tells WIRED that the company “complies with all laws and regulations and sells only to vetted intelligence and law enforcement agencies, which use these technologies daily to prevent crime and terror attacks.” Lainer adds that NSO “has initiated and implemented the industry’s leading compliance and human rights program, which protects against misuse by government entities and investigates all credible claims of misuse”

Ultimately, the current administration will have the final say on how the US regulates NSO Group.

Senator Ron Wyden of Oregon, who has actively worked to address concerns related to surveillance and spyware, tells WIRED that “the Biden Administration blacklisted NSO” because its tool was used to “maliciously targeting journalists, human rights workers, and even US government officials around the world on behalf of foreign dictators and making all Americans less safe.”

“If Donald Trump puts the NSO Group back in business,” Wyden adds, “he'll be directly responsible for opening up new threats to our national security and enabling atrocities by foreign dictators.”

Spyware Maker NSO Group Is Paving a Path Back Into Trump’s America

Plus: Another DOGE operative allegedly has a history in the hacking world, and Donald Trump’s national security adviser apparently had way more Signal chats than previously known.

The biggest news this week is inarguably the Trump administration’s baffling tariffs, which have rattled the global economy, impacting everything from the US tech industry to literal penguins, leaving most of the world wondering what comes next. But if you’re looking for a mystery that doesn’t feel quite so, well, _existential_, look no further than Indiana University.

On March 18, the FBI raided the homes of Xiaofeng Wang, a data privacy professor and researcher who worked at the IU for more than 20 years. The same day, according to a termination email viewed by WIRED, Wang was fired from his job, and people soon noticed that he and his wife seemed to have disappeared.

A WIRED investigation found that the university was looking into whether Wang received unreported research funding from China prior to his position being terminated. IU also removed from its website Wang’s profile as well as the profile of his wife, Nianli Ma, who worked as a library systems analyst. An attorney for Wang and Ma say they are “safe,” and Wang has reportedly taken a position at a university in Singapore. As of earlier this week, the couple’s attorney was unaware of any charges against either of them.

The large language models behind generative AI tools may be black boxes, but one company’s leaky server has provided some accidental insight into how people are using these tools. The short answer? It’s not great. Security researcher Jeremiah Fowler discovered an unsecured database with more than 95,000 records linked to South Korea-based image-generation tool GeNomis. The records contained prompts for creating images, as well as some images themselves, which included de-aged pictures of celebrities like Ariana Grande and Beyoncé made to look like children, and what appeared to be AI-generated child sexual abuse material. The GeNomis website went offline hours after WIRED reached out for comment.

And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

The Trump administration has reportedly fired the director of the National Security Agency at the urging of far-right activist Laura Loomer. According to multiple reports, Loomer brought to an Oval Office meeting on Wednesday a list of about a dozen officials she claimed were insufficiently loyal to President Donald Trump. Among them were General Timothy Haugh—who led both the NSA and US Cyber Command—and his civilian deputy, Wendy Noble, who has reportedly also been removed from her post.

According to CNN, Loomer specifically targeted Haugh, arguing for his removal because he had been selected by Mark Milley, the former Joint Chiefs of Staff chairman. Milley, who publicly clashed with Trump, was quoted in a book by journalist Bob Woodward calling the former president “fascist to the core.” In a post on X, Loomer claimed that Haugh and Noble “have been disloyal to President Trump. That is why they have been fired.”

Haugh’s and Noble’s reported dismissals came just hours after several National Security Council staffers were also forced out following the Oval Office meeting that included Loomer.

Speaking aboard Air Force One on Thursday, Trump confirmed the NSC dismissals and acknowledged Loomer’s role in advising him. “She makes recommendations … and sometimes I listen to those recommendations … I listen to everybody and then I make a decision,” he said.

Loomer, who has promoted conspiracy theories about the 9/11 attacks and espoused anti-immigrant and anti-Muslim rhetoric, has become an increasingly vocal presence within Trump’s political orbit. In recent weeks, she has publicly attacked members of Trump’s own team, accusing them of undermining his agenda. “Laura Loomer is a very good patriot,” Trump said on Thursday. “She is a very strong person.”

****DOGE Operative Linked to Alleged Hacking Past****

On Monday, Reuters reported that an operative from Elon Musk’s so-called Department of Government Efficiency (DOGE) assigned to the US Justice Department was previously a hacker who ran websites distributing pirated ebooks and software. According to a Reuters review of domain registration data and archived pages from the Wayback Machine, one such site, fkn-pwnd.com, featured the slogan “Fucking Up Servers!” alongside a crude sketch of a penis.

Christopher Stanley, a 33-year-old engineer who has worked at both Musk's social media company X and space company SpaceX, is a senior adviser in the deputy attorney general's office, according to a former Justice Department official and a staff directory listing reviewed by Reuters. Starting about 10 years before joining SpaceX, Stanley allegedly ran several online forums that covered software piracy, video game cheats, and hacking. Reuters reports that he used various pseudonyms on those sites, including eNkrypt and Reneg4d3. The fkn-pwnd.com site, launched in 2006, would have been created when Stanley was in high school.

The Reuters report follows inquiries into another DOGE technologist, Edward Coristine, who worked briefly for a firm known for hiring reformed hackers, a WIRED investigation found.

****Waltz’s Team Allegedly Had at Least 20 Signal Group Chats****

Last week, The Atlantic exposed a staggering operational security failure when it reported that someone using the Signal account belong to national security adviser Mike Waltz accidentally invited the publication’s editor-in-chief to a private Signal group chat discussing a covert bombing operation in Yemen. Now, Politico reports that Waltz’s team has routinely used Signal chats—on a far broader scale than previously known—to coordinate official work on sensitive issues including Ukraine, China, Gaza, the Middle East, Africa, and Europe.

Sources who spoke to Politico on the condition of anonymity say they were directly involved in or had knowledge of at least 20 such group chats. While none of the four individuals could confirm whether classified information was shared, all said the discussions regularly included sensitive national security details. In the wake of these revelations, Waltz and other US government officials have also come under scrutiny for leaving their Venmo accounts public and reportedly using personal Gmail addresses for government business.

On Thursday, the Pentagon’s acting inspector general announced a review of defense secretary Pete Hegseth’s use of the encrypted Signal app to share plans for operations against the Houthis in Yemen.

NSA Chief Ousted Amid Trump Loyalty Firing Spree

A lawyer for Xiaofeng Wang and his wife says they are “safe” after FBI searches of their homes and Wang’s sudden dismissal from Indiana University, where he taught for over 20 years.

Before the official faculty profiles of renowned Indiana University, Bloomington (IU) data privacy professor Xiaofeng Wang and his wife disappeared and the FBI raided two of the couple’s homes last week, the school is said to have been reviewing for months whether the professor received unreported research funding from China, WIRED has learned.

Indiana University contacted Wang in December to ask about a 2017-2018 grant in China that listed Wang as a researcher, according to an unsigned statement that appears to be written by a Purdue University professor and long-time collaborator of Wang seen by WIRED. The statement says that the author believed IU was concerned that Wang allegedly failed to properly disclose the funding to the university and in applications for US federal research grants.

The statement has been circulating among cybersecurity and privacy scholars at universities around the world in recent days and was sent to WIRED by three separate sources. It claims that Wang had explained the funding situation to IU, then was told in February that the school would continue looking into the matter.

Alex Tanford, a professor emeritus at Indiana University and the IU Bloomington Chapter president of the American Association of University Professors, says Wang reached out to him and said that he had been accused of alleged research misconduct. Tanford says he provided Wang guidance as a member of the faculty board of review. IU did not answer WIRED’s questions regarding any probes into Wang.

“The charge seemed trivial—that he had failed to properly disclose who was principal investigator on a grant application and had not fully listed all his coauthors on an article,” Tanford tells WIRED of the allegations. He says Wang wanted to know if the university had the right to lock him out of his office and computer, as he was in the middle of ongoing research.

Research papers Wang published between 2017 and 2018 list funding from places like the National Science Foundation, National Institutes of Health, the US Defense Advanced Research Projects Agency, the US Army Research Office, Google, and Samsung, according to a WIRED review of his publications from the time period.

Wang regularly collaborated with researchers at the Institute of Information Engineering (IIE) at the Chinese Academy of Sciences, a government-funded cybersecurity research lab. In papers, Wang and his coauthors disclosed that the IIE scholars received funding from sources such as the National Natural Science Foundation of China, but that Wang was being supported by US grants. It’s not uncommon for professors at US institutions to collaborate with researchers in China, and there's no public evidence to suggest that the arrangements were improper.

According to the unsigned statement’s title and metadata, it appears to have been authored by Ninghui Li, a computer science professor at Purdue who has collaborated on research with Wang since at least 2006. The pair also serve together on the board of the ACM Special Interest Group on Security, Audit, and Control (SIGSAC), which aims “to develop the information security profession by sponsoring high quality research conferences and workshops,” according to the Association for Computer Machinery’s website. Li did not respond to emailed requests for comment nor a voicemail left on his office phone.

Jason Covert, one of attorneys representing Xiaofeng Wang and his wife, Nianli Ma, a library systems analyst whose employee profile was also removed by Indiana University, tells WIRED that Wang and Ma are both “safe” and that neither of them have been arrested. Their legal team is not currently aware of any pending criminal charges against them, and while the couple’s attorneys have viewed a search warrant from the Department of Justice, Covert says they have not received a copy of the affidavit establishing probable cause.

Wang is considered among the top researchers in the field of privacy, data security, and biometric privacy, and his sudden disappearance came as a shock to many of his academic peers. Wang joined IU in 2004 and is the lead principal investigator of the multidisciplinary Center for Distributed Confidential Computing, which he established in 2022 with an almost $3 million grant from the National Science Foundation (NSF), according to a since-deleted bio on IU’s website. As part of his application for the NSF funding and other US federal research grants, Wang would have been required to disclose other grants he already received or were currently pending review.

On March 28, the FBI searched two home addresses associated with Wang. The same day, IU also reportedly terminated Wang’s job via an email sent by provost Rahul Shrivastav, which WIRED obtained and was first reported by The Indiana Daily Student. The email also said it was understood that Wang had recently accepted a position with a university in Singapore, a detail also repeated in the statement attributed to Li.

The statement says Wang planned to start at the unnamed Singaporean university on June 1, 2025, and requested a leave of absence from Indiana University in early March. But IU responded by “putting him on administrative leave, removing his IU homepage, and disabling his IU email address,” it claims.

Wang’s new job offer “would be irrelevant in any event because it is for \[the\] next academic year and would not justify firing him,” Tanford says. Terminating his employment via an email was a violation of university policy, Tanford claims, which prohibits firing a tenured professor without cause, and requires a 10-day notice and a hearing before a faculty board of review, if requested by the staff member. “The faculty is deeply concerned. If the administration can fire a tenured professor without due process and in violation of a policy approved by our trustees, none of us is safe,” he says.

Reached for comment, an IU spokesperson declined to answer detailed questions from WIRED about prior communications between the university and Wang and the school’s decision to fire him.

“Indiana University was recently made aware of a federal investigation of an Indiana University faculty member,” university spokesperson Mark Bode tells WIRED in an emailed statement. “At the direction of the FBI, Indiana University will not make any public comments regarding this investigation. In accordance with Indiana University practices, Indiana University will also not make any public comments regarding the status of this individual.”

The FBI has so far not commented on the reason for its activities surrounding Wang’s properties. In a statement sent to WIRED, Indianapolis-based spokesperson Chris Bavender says, “The FBI conducted court authorized law enforcement activity at homes in Carmel and Bloomington, Indiana last Friday. We have no further comment at this time.”

WIRED could not immediately reach Wang or Ma for comment directly, but Covert, their attorney, provided a statement on their behalf.

“Prof. Wang and Ms. Ma are thankful for the outpouring of support they have received from colleagues at Indiana University and their peers across the academic community,” the statement reads. “They look forward to clearing their names and resuming their successful careers at the conclusion of this investigation.”

To many in the academic research community, the events surrounding Wang and another Chinese-born scholar in Florida who was fired recently are reminiscent of the China Initiative, a US Department of Justice campaign launched under the first Trump administration to combat cybercrime and economic espionage. Critics accused the program of unfairly targeting Chinese-born researchers and broader Asian-immigrant and Asian-American academic communities.

The DOJ abandoned the program under the Biden administration in 2022 after it lost or withdrew charges in a number of associated cases. At the time, a top DOJ official said it had “helped give rise to a harmful perception” that there are lower standards for prosecuting conduct related to China, and people with ties to the country are treated differently. But several congressional efforts have since sought to resurrect the program or start similar law enforcement campaigns, including a 2023 bill that passed the House but not the Senate last year.

“We, like many other organizations and individuals, have broad concerns that the end of the \[China Initiative\] is just in name but does not reflect a change in fact and substance,” Jeremy Wu, the coorganizer of APA Justice, a nonprofit organization that advocates against racial profiling, said in a March webinar at the Michigan State University. Wu declined WIRED’s request to comment on the events surrounding Wang.

Matthew Green, a professor at Johns Hopkins University who specializes in cryptography and cryptographic engineering says that, while he doesn’t know Wang personally, he is troubled by how secretive Indiana University has been about the circumstances that led to his alleged firing. “This is not normal behavior by a university,” Green tells WIRED.

Green says he worries that cases like Wang’s could make young engineers from China think twice about studying at American universities, and even motivate talented researchers who have lived in the US for decades to instead consider working abroad. “We may lose a huge amount of expertise,” Green says.

Source

Wired