We're rolling out a brand new feature in Malwarebytes for iOS: the ability to block Google sponsored ads directly on Safari.

Sponsored ads on Google search don’t just irritate users—they also provide a dangerous opportunity for cybercriminals to spread malware and scams to their unsuspecting victims. What looks like a harmless search result can be a carefully disguised trap.  

At Malwarebytes, our researchers have uncovered a variety of threats hiding in plain sight within these sponsored ads, including Mac stealers distributed through Google Ads, scams targeting popular utility software, and tech support traps.  

In some cases, scammers use advanced AI tools like DeepSeek AI to create convincing ads and web pages, increasing the risk to unsuspecting users.  

That’s why we’re excited to roll out a brand new feature in Malwarebytes for iOS: the ability to block Google sponsored ads directly on Safari.  

If you’ve used our iOS app before, you already know it blocks ads on webpages and ad trackers. But with our newest feature, we’re extending protection to cover those annoying and potentially dangerous sponsored ads listed on search results.  

Now, with just a simple toggle, you can make those annoying sponsored ads disappear from your Safari browsing experience.  

**Try it for yourself**: Download Malwarebytes for iOS and enjoy this feature—alongside scam text filtering, a privacy VPN, and call protection—with a free seven-day trial.  

Existing users should already have this feature option in their app—check it out now!

**Don’t have an iOS device?** Download our free Browser Guard extension for ad blocking and scam protection while browsing on your desktop.

 Tired of Google sponsored ads? So are we! That’s why we’re introducing the option to block them on iOS     

Meta has won almost $170m in damages from Israel-based NSO Group, maker of the Pegasus spyware.

Meta has won almost $170m in damages from Israel-based NSO Group, maker of the Pegasus spyware. The ruling comes after a six-year legal case against the company after Meta accused it of misusing its servers to spy on users.

According to the original complaint against NSO Group, filed in October 2019, the spyware vendor used WhatsApp servers to send malware to around 1400 mobile phones. The purpose was to gain access to the messages on those devices, which were typically used by attorneys, journalists, human rights activists, political dissidents, diplomats, and other senior foreign government officials.

NSO Group reverse engineered WhatsApp’s software and developed its own software and servers to send messages to victims via the WhatsApp service that contained malware. That malware installed itself on the victims’ smartphones using a zero-click attack, meaning that the victim didn’t have to take any action such as opening an link or even answering a call for the compromise to happen; it was enough simply for the message to arrive.

A judge ruled in December that NSO Group had repeatedly dodged requests to provide its code for review, and granted Meta partial summary judgment over the vendor. That set up conditions for a trial to determine damages that started in late April.

NSO Group reportedly argued that Facebook lost nothing as part of the attack, arguing that it should pay the minimum amount in damages. However, the jury awarded Meta $444,719 in compensatory damages and $167,254,000 in punitive damages.

NSO Group is no stranger to controversy. The US federal government blacklisted it in 2021 for enabling foreign governments to spy on a range of people in acts of “transnational repression”. The same year, investigative website The Pegasus Project alleged that the company targeted over 180 journalists around the world. The European Data Protection Supervisor recommended an EU ban on the technology in 2022, although this has not yet happened.

The ruling drew praise from Amnesty International, which had filed a court brief as part of the case outlining the human rights implications of the attacks on Meta. The organization commented:

> “This decision should serve as a wake-up call to governments to take proactive, concrete steps to regulate the surveillance industry, to enforce safeguards on their surveillance practices, and to comprehensively ban tools that are inherently incompatible with human rights obligations and standards, such as Pegasus,”

One takeaway stands out for our readers: end-to-end encryption is important for privacy, but it is not enough on its own.

As Meta pointed out in its complaint, NSO couldn’t decrypt WhatsApp messages in transit to users because they are encrypted when they’re sent from one device and stay unreadable until they’re decrypted by the receiving device. However, that doesn’t stop someone from reading the messages after they’re decrypted by the receiving device—someone who compromises your smartphone or PC has control over all of the data on it, including those decrypted messages.

For consumers, this means applying more layer of protection in the form of regular updates, security software, and cybersecurity awareness. Never open links, files, or videos from someone you don’t know. Be skeptical even if they’re from someone you do know—we recommend checking with them over a different channel first to ensure it was really them that sent it.

In this case, even that would not have enough, because NSO Group was able to infect phones without the victim even answering the call. Attacks this sophisticated often target people with sensitive roles such as journalists, activists, and government workers. Google has an advanced protection program for people like this, while Apple launched lockdown mode for high-risk users. Facebook has its own initiative.

**We don’t just report on phone security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.

 WhatsApp hack: Meta wins payout over NSO Group spyware 

CBP says it has “disabled” its use of TeleMessage following reports that the app, which has not cleared the US government’s risk assessment program, was hacked.

The United States Customs and Border Protection agency confirmed on Wednesday that it uses at least one communication app made by the service TeleMessage, which creates clones of popular apps like Signal and WhatsApp with the addition of an archiving mechanism for compliance with records-retention rules.

“Following the detection of a cyber incident, CBP immediately disabled TeleMessage as a precautionary measure,” CBP spokesperson Rhonda Lawson tells WIRED. “The investigation into the scope of the breach is ongoing.”

President Donald Trump's now former national security adviser Mike Waltz was photographed last week using TeleMessage Signal during a cabinet meeting, and the photo seemed to show that he was communicating with other high-ranking officials, including Vice President JD Vance, US director of national intelligence Tulsi Gabbard, and what appears to be US secretary of state Marco Rubio.

In the days since the photo was published, TeleMessage has reportedly suffered a series of breaches that illustrate concerning security flaws. Analysis of the app's Android source code also appears to indicate fundamental flaws in the service's security scheme. As these findings emerged, TeleMessage—an Israeli company that completed an acquisition last year by the US-based company Smarsh—imposed a service pause on its products pending investigation.

“TeleMessage is investigating a potential security incident. Upon detection, we acted quickly to contain it and engaged an external cybersecurity firm to support our investigation,” a Smarsh spokesperson told WIRED in a statement on Monday. “Out of an abundance of caution, all TeleMessage services have been temporarily suspended. All other Smarsh products and services remain fully operational.”

WIRED contacted CBP about its potential use of the software after some data stolen from TeleMessage in one of the recent breaches indicated that CBP was potentially a customer.

US senator Ron Wyden called for the Department of Justice to investigate TeleMessage in a letter on Tuesday, alleging that the service is “a serious threat to US national security.” TeleMessage is a federal contractor, but the consumer apps it offers are not approved for use under the US government's Federal Risk and Authorization Management Program, or FedRAMP. In his letter, Wyden referenced that “several federal agencies” use TeleMessage, asserting that the company “sold dangerously insecure communications software to the White House and other federal agencies.”

There is still no complete public accounting of US government officials and agencies that have used the software.

Customs and Border Protection Confirms Its Use of Hacked Signal Clone TeleMessage

In the wake of SignalGate, a knockoff version of Signal used by a high-ranking member of the Trump administration was hacked. Today on Uncanny Valley, we discuss the platforms used for government communications.

All products featured on WIRED are independently selected by our editors. However, we may receive compensation from retailers and/or from purchases of products through these links.

When former national security adviser Mike Waltz had a picture taken of him last week, he didn’t expect for the whole world to see that he was using TeleMessage, a messaging app similar to Signal. Now the app has been hacked, with portions of data linked to government entities like Customs and Border Protection (CBP) and companies like Coinbase. Today on the show, we’re joined by WIRED senior writer Lily Hay Newman to discuss what this incident tells us about the growing vulnerabilities in government communications.

Articles mentioned in this episode:  
**Mike Waltz Has Somehow Gotten Even Worse at Using Signal**, by Lily Hay Newman  
**The Signal Clone the Trump Admin Uses Was Hacked** , by Joseph Cox and Micah Lee  
**The Signal Clone Mike Waltz Was Caught Using Has Direct Access to User Chats**, by Lily Hay Newman

You can follow Zoë Schiffer on Bluesky at @zoeschiffer and Lily Hay Newman on Bluesky at @lhn. Write to us at uncannyvalley@wired.com.

**How to Listen**

You can always listen to this week's podcast through the audio player on this page, but if you want to subscribe for free to get every episode, here’s how:

If you're on an iPhone or iPad, open the app called Podcasts, or just tap this link. You can also download an app like Overcast or Pocket Casts and search for “Uncanny Valley.” We’re on Spotify too.

**Transcript**

_Note: This is an automated transcript, which may contain errors._

**Zoë Schiffer:** Hi, this is Zoë. Before we start, I want to take the chance to remind you that we want to hear from you. If you have tech-related questions that have been on your mind or a topic that you wish we'd cover, write to us at uncannyvalley@WIRED.com. And if you listen to and enjoy the show, please rate it and leave a review on your podcast app of choice. It really honestly makes a difference. Welcome to WIRED's _Uncanny Valley_. I'm WIRED's director of business and industry, Zoë Schiffer. Today on the show, the hacking scandal surrounding TeleMessage, the knockoff version of Signal, which is used by at least one high-ranking member of the Trump administration. The app has temporarily suspended its services while it investigates the incident. We're going to talk about how former national security adviser Mike Waltz was seen last week using the app in a cabinet meeting and what this latest incident tells us about the growing vulnerabilities in government communication. I'm joined by Lily Hay Newman, senior writer at WIRED. Lily, welcome to the show.

**Lily Hay Newman:** It's a pleasure to be here.

**Zoë Schiffer:** What exactly is TeleMessage?

**Lily Hay Newman:** Yeah. So TeleMessage is a company that's been around since the late ’90s. It was founded in Israel, and it creates apps that are sort of mirror images or clones of existing communication apps, and then adds in an archiving feature. So this is especially perhaps wanted for apps that are securing communications, such that it's difficult to retain copies of the messages. So if you need copies for compliance or you need a record, the idea is that these services are giving the same functionality as apps you know, like WhatsApp or Telegram or Signal, but with the addition of these archiving features.

**Zoë Schiffer:** And that's important, obviously, for people who work in government because, technically, members of the press and other people are supposed to be allowed to access a lot of the communications that aren't classified by submitting Freedom of Information Act requests. And you can't do that if the messages are disappearing.

**Lily Hay Newman:** Correct. There are record retention laws in the US and other countries for transparency and information requests, as you said. But historically, the way governments and other institutions have complied with that is by using communication platforms that are built for the purpose of government communications, tailor-built to be in compliance in a number of ways. So all of this is coming up because now the Trump administration in recent months has been sort of departing from the standard ways that officials in the US have communicated to use consumer platforms, particularly the secure messaging platform Signal, to talk to each other, but doing so in a very ad hoc consumer way like in the same way that you and I would set up a Signal conversation. That's what they've been doing, and that's where you get into this whole question of how do you comply with records requirements. How do you comply with safety requirements when you're just kind of using off-the-shelf tech in a regular way? And so that's where TeleMessage comes in.

**Zoë Schiffer:** Well, it seems like one of the people, as we mentioned earlier, who was using TeleMessage was Mike Waltz, the now former national security adviser, who at this point is best known for starting that infamous Signal group chat a few weeks back that accidentally added a senior member of The Atlantic Newsroom. How did we find out that he was using TeleMessage in the first place?

**Lily Hay Newman:** So his screen, the screen of his phone, was sort of inadvertently captured in a photo of a cabinet meeting, a Reuters photo, that Mike Waltz was participating in, was sitting at the table with Trump and a number of officials. The photo is a bit funny because it seems like he thinks no one can see him using his phone, or he is kind of checking his phone. I mean, we've all been there, looking under the conference table at our phone. But additionally, his screen shows what appears to be Signal. So we're really going, zooming in deep into this photo, right. We're looking over his shoulder at his phone. Now we're seeing this notification. And then in the notification, instead of the normal words that would be there, people noticed that the Signal … where it would normally say Signal, was being referred to as TM Signal. And that's how people realized that, actually, he was using this other app called TeleMessage.

**Zoë Schiffer:** Got it. Yeah. Nothing makes me love reporters more than the absolute psychotic behavior of zooming in on a tiny little phone screen to be like, “What exactly is going on here?” But kudos to 404 Media, because I think they were the first ones to point that out. You wrote in a recent WIRED article that Mike Waltz has inexplicably gotten even worse at using Signal. So, I guess what did you mean by that? How is he getting worse at using this end-to-end encrypted app?

**Lily Hay Newman:** This whole revelation about his use of TM Signal is building on this previous situation called Signal Gate. Mike Waltz was the person who inadvertently added Jeffrey Goldberg, the top editor of The Atlantic, to the chat. And so already Mike Waltz was not having a great track record, and then disappearing messages were on the whole time. And so, one of the many criticisms was that this was not in compliance with government record-retention laws. So we don't know this, but presumably then he started using TM Signal as a solution to that aspect of the issues raised. But I just want to be clear. We don't know. It could be that they were already using it, or he was already using TM Signal at the time. I'm not sure. But one might suspect that hearing some of this criticism, he was like, “OK, let me find a solution that does retain records and does have an archiving feature.” And that's where TeleMessage would come in.

**Zoë Schiffer:** So the national security advisoer sets up this group chat, presumably not in compliance, then switches to one that looks like it might be in compliance, and then that version is promptly hacked. Do we know at this point who is behind the hacking?

**Lily Hay Newman:** More and more is coming out about potential hacks of TeleMessage or sort of ability to intercept messages and see messages in memory. First, 404 Media and Micah Lee published a piece with an unnamed hacker providing evidence that they could breach TeleMessage. And then, on Monday, NBC News published an additional report with an additional unnamed hacker. So clearly there's a lot of insecurity here. And the criticism of TM Signal from this company, TeleMessage, is that it claims to have all the same security features as real Signal and to sort of preserve that, and just add on this archiving feature. But, definitionally, adding in the archiving feature breaks Signal security. The way signal is designed and other end-to-end encrypted apps like WhatsApp, when you add in this other party, it's virtually impossible that the security guarantees could be preserved. And then, on top of that, it seems like from source code review that's starting to come out, and research that's starting to happen, and analysis into TM Signal, that actually it's just not constructed in a very secure way at all. So, just a lot of layers to get to the point, which is that this was a wildly insecure app for Mike Waltz to be using, sitting at a table with the top cabinet members and the president of the United States. It's wild.

**Zoë Schiffer:** We're going to get into what exactly was accessed in this hack. But before we do that, we're going to take a short break.

\[_break_\]

**Zoë Schiffer:** We are back. So let's get into what exactly was accessed when it looks like multiple hackers were able to break into TM Signal, which was being used by at least one member of the Trump administration.

**Lily Hay Newman:** So far, these researchers, what they've shown is that some messages, sometimes at least, are being sent to the archiving server in plain text, meaning they are readable. That's precisely what a platform like genuine Signal is trying to avoid. And so that's what's happening. So these were sort of fragments or pieces or whole messages, but not whole conversations, things like that, so far. One thing that 404 Media reported on from these leaks was evidence that US Customs and Border Patrol agents have been using TM Signal. It's not totally clear what's going on with this. WIRED reached out to CBP. We've been trying to get clarification on what this leaked data means. There seem to be confirmed CBP phone numbers associated with these accounts that came out of this breach. CBP has told WIRED just that they're looking into it. But that's an example that is really concerning, it would potentially show that this app is in wider use across other agencies in the US government.

**Zoë Schiffer:** Is there a national security concern with the fact that this app was developed in Israel, regardless of the fact that it was acquired by a US company recently?

**Lily Hay Newman:** The thing is, even without getting into any specific geopolitics, the point of the protocols that exist for the US government to use its own purpose-built communication platforms is that any and all foreign governments conduct espionage. The US does it. Everyone does it. So, for your most sacred and sensitive national communication, you want to do that on a platform that you completely control, that you have built and vetted yourself, and just all parameters are controlled by you. You don't want to involve any other parties. So Israeli espionage groups are known for being very aggressive, very innovative, very cunning. So, for that reason, particularly, perhaps it's a concern that TeleMessage was founded in the country and has those ties. But just in general, regardless of what country it is, I think it's important conceptually to understand that it doesn't make sense to use the app in this way.

**Zoë Schiffer:** After this reporting came out, TeleMessage has paused or stopped its services. What's the status of the company right now?

**Lily Hay Newman:** Right. So clearly, they have concerns, and their parent company, Smarsh, has concerns about these findings as well. They say that they are investigating a potential breach and have employed a third-party firm to help them with that. And they've taken down all the content from the TeleMessage website and paused TeleMessage operations, essentially. So they say it's a pause and pending the investigation, but a pretty big reaction here to these findings.

**Zoë Schiffer:** That's a good place to end it. When we come back, we'll share our recommendations for what to check out on WIRED.com this week. Welcome back to _Uncanny Valley_. I'm Zoë Schiffer, WIRED's director of business and industry. I'm joined today by WIRED senior writer Lily Hay Newman. Before we take off, Lily, tell our listeners what they absolutely have to read on WIRED this week.

**Lily Hay Newman:** I'm just fascinated by this story by our colleague Caroline Haskins. US border agents are asking for help taking photos of everyone entering the country by car. And this is, we're just continuing our CBP discussions for today. CBP has apparently released a request for information seeking pitches, essentially for companies to help them do vehicle surveillance at the border and face recognition technology to see specifically who is in cars, not just the front seat. And I think it's really important for all of us to be aware of the extensive and expansive surveillance dragnet at the US border and all different types of US border crossings. The southern border of the US has long been known as sort of like a forefront of surveillance technology. And so it's dark, but interesting to hear that CBP feels like they don't yet have what they need to do this type of analysis and face recognition in cars, but that they want it, and they're trying to expand the analysis they can do on who is in every car.

**Zoë Schiffer:** Right. And it'll be interesting to see which company gets this contract. OK. Well, I wanted to flag a piece that we published yesterday by Paresh Dave and Kylie Robison. It's about OpenAI announcing that it is not, in fact, going to restructure its company to make the nonprofit arm not in control. In other words, the nonprofit arm is going to remain in control of the company. And this is a reversal of a prior announcement where it said it was going to become a public benefit corporation, likely to make fundraising easier. But after the plan was announced, the company got a ton of pushback from a variety of civic organizations and also Elon Musk, who was involved in the founding of the company before an acrimonious split in 2018. These groups don't usually agree on a lot, but they agreed on this, that becoming a for-profit company was in violation of OpenAI's founding mission. So we have a lot of good reporting on how people are taking this news and what it means for the future of the company. That's our show for today. We'll link to all the stories we spoke about in the show notes. Make sure to check out Thursday's episode of _Uncanny Valley_, which is about Trump's meme coin saga and the conflict of interest that come with it. Adriana Tapia produced this episode. Amar Lal at Macro Sound mixed this episode. Jordan Bell is our executive producer. Condé Nast's head of global audio is Chris Bannon. And Katie Drummond is WIRED's global editorial director.

The Trump Administration Sure Is Having Trouble Keeping Its Comms Private

US jury orders NSO Group to pay $168M to WhatsApp and Meta over Pegasus spyware use in 2019…

US jury orders NSO Group to pay $168M to WhatsApp and Meta over Pegasus spyware use in 2019 hack. Meta calls it a major step for user privacy protection.

A US federal jury has ruled in favour of WhatsApp and its parent company Meta, ordering Israeli spyware firm NSO Group to pay nearly $168 million in damages. The verdict follows years of legal battles over NSO’s use of its Pegasus spyware to infiltrate WhatsApp users’ devices.

The decision comes after WhatsApp first filed a lawsuit in 2019, accusing NSO Group of using a vulnerability in the platform’s video calling feature to install spyware on approximately 1,400 devices. Victims included journalists, human rights activists, diplomats, and others across multiple countries.

According to court filings (PDF), NSO’s Pegasus spyware was deployed by sending a WhatsApp call that didn’t even need to be answered. Once the call was placed, the malicious code would install itself, granting access to private messages, calls, camera feeds, and more.

The jury awarded $167.25 million in punitive damages and over $440,000 in compensatory damages to WhatsApp and Meta, bringing the total close to $168 million. Meta said the ruling represents a strong message against surveillance-for-hire businesses and a win for digital privacy.

“The jury’s decision to force NSO to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and our users worldwide,” said Meta in a statement following the ruling. The company added that it would continue pushing for stronger legal protections for users and tougher consequences for those abusing digital surveillance tools.

NSO Group has consistently denied wrongdoing, claiming its software is only sold to vetted government agencies for lawful use in preventing crime and terrorism. In response to the ruling, NSO announced its plans to appeal, reiterating that its tools were not intended to target individuals indiscriminately.

“We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies,” Gil Lainer, vice president of global communications for NSO Group, said in a statement Tuesday.

“We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal,” Lainer added, adding that the company “remains fully committed to its mission to develop technologies that protect public safety” while working within legalities.

Legal experts note that the ruling could set a precedent for holding spyware developers accountable in civil courts, especially when their tools are used against individuals without legal oversight. While NSO faces other lawsuits worldwide, this case may become a turning point in how private surveillance firms are treated under U.S. law.

The lawsuit and resulting fine also show the growing industry of commercial spyware, where private companies create powerful surveillance tools often used far beyond their original purpose. Pegasus has become one of the most high-profile examples due to its widespread use and the sensitivity of its targets.

Nevertheless, Meta’s victory not only brings a degree of closure to a five-year legal dispute but also pressures other spyware vendors to reconsider how their technologies are used and sold. Whether the fine leads to overall changes in the spyware industry remains to be seen, but it’s clear the legal risks are rising.

Israeli NSO Group Fined $168M for Pegasus Spyware Attack on WhatsApp

A federal jury on Tuesday decided that NSO Group must pay Meta-owned WhatsApp WhatsApp approximately $168 million in monetary damages, more than four months after a federal judge ruled that the Israeli company violated U.S. laws by exploiting WhatsApp servers to deploy Pegasus spyware, targeting over 1,400 individuals globally.
WhatsApp originally filed the lawsuit against NSO Group in 2019,

NSO Group Fined $168M for Targeting 1,400 WhatsApp Users With Pegasus Spyware

TM SGNL, a chat app by US-Israeli firm TeleMessage used by Trump officials, halts operations after a breach…

TM SGNL, a chat app by US-Israeli firm TeleMessage used by Trump officials, halts operations after a breach exposed messages and backend data.

A data breach has exposed security flaws and sensitive information in TM SGNL, a chat app developed by the Israeli-US company TeleMessage. The firm is known for providing modified versions of encrypted messaging apps such as Signal, WhatsApp, Telegram, and WeChat, to the US government.

This alleged breach, first reported by 404 Media, involved a hacker gaining access to archived messages, including direct and group chats. As a result, the company has temporarily suspended its operation.

The hack raises serious concerns about the security of communications at the highest levels of the US government, particularly as former National Security Advisor Mike Waltz was recently seen using TM SGNL during a cabinet meeting with President Trump.

This sparked immediate scrutiny since unlike Signal, TM SGNL is not available on public app stores. At the time of writing, TeleMessage’s official website remains online, but all references to the app, its services, and related activity have been removed.

Reportedly, Smarsh, TeleMessage’s corporate owner, is currently rebranding the service as Capture Mobile. However, the Wayback Machine shows the website’s archive pages and installation guide for both iOS and Android devices.

****The Hacker Remains Anonymous****

The hacker, who remains anonymous, claimed to have breached TeleMessage’s backend infrastructure in a mere “15-20 minutes,” highlighting the ease of access. The stolen data includes message contents, contact information of government officials, usernames and passwords for TeleMessage’s backend panel, and indications of client agencies and companies.

The companies include Customs and Border Protection (CBP) and cryptocurrency giant Coinbase. However, it was confirmed that the hacker did not obtain messages from Trump cabinet officials or Waltz himself.

Internal screenshot from the TeleMessage app which the hacker shared with 404 Media

****Analysis Reveals Critical Flaws in TM SGNL****

Software engineer Micah Lee, who managed to analyse the app’s source code uncovered serious vulnerabilities, including hardcoded credentials. While the nature of the hardcoded credentials was not specified, their presence indicates a serious security flaw.

Furthermore, TeleMessage modifies Signal to add message archiving capabilities, a feature likely used by government officials for record-keeping compliance. However, this modification involves storing decrypted messages on a cloud server, creating a potential security risk.

The main issue is that messages are only encrypted within the app and not end-to-end secured during archiving. They are decrypted and stored in plaintext on TeleMessage’s servers, which are vulnerable to unauthorized access.

The hacker confirmed that the breached server was the same Amazon Web Services (AWS) server used for message archiving, confirming the vulnerability.

A Signal spokesperson reiterated that the company “cannot guarantee the privacy or security properties of unofficial versions of Signal,” further emphasizing the risks associated with modified apps like TM SGNL

The incident highlights the continued use of apps like Signal and TM SGNL by government officials, despite the availability of secure communication systems, raising questions about their choice and the risky assumptions they make about smartphone app security. It also highlights the need for a thorough reassessment of government officials’ communication tools, particularly those involving sensitive information and record-keeping regulations.

Chat App Used by Trump Admin Suspends Operation Amid Hack

Fake Qantas emails in a sophisticated phishing scam steal credit card and personal info from Australians, bypassing major…

Fake Qantas emails in a sophisticated phishing scam steal credit card and personal info from Australians, bypassing major email security filters.

Australian airline Qantas is being targeted by criminals with fake emails claiming to be from the airline. Security experts at Cofense Intelligence, who discovered this attack, found that these convincing emails trick users into giving away their credit card information and personal information like phone numbers and addresses.

These fake Qantas emails mimic real marketing emails, using the same colours, and layout as real ones and “with appropriate branding and functional links.” One clever trick the criminals used was to include an “unsubscribe” link in the emails, just like real marketing emails do.

However, the links in the fake emails didn’t go to Qantas’s official website. Instead, they went to other websites. Experts believe the criminals might have used these fake unsubscribe links to see which email addresses were real and active.

Interestingly, according to Cofense’s report, the fake emails mentioned that Qantas was celebrating its 103rd anniversary. However, Qantas’s 103rd anniversary was actually in 2023, two years ago. This was one of the few mistakes in the otherwise very convincing emails.

Source: Cofense Intelligence

The emails tricked people into clicking on links to fake websites, often containing the phrase “auth/auhs1” followed by random words related to Qantas or coupons. These websites generally disappeared within a day and asked for personal information in a multi-step process, including name, phone number, email address, and home address. This collected contact information, along with the date of birth, could be used for targeted scams or password guessing.

These fake websites allegedly attempted to set up multi-factor authentication after a user entered their credit card information, but this failed. Experts believe that this extra step was added to deceive victims into believing there was a problem with their end rather than the website.

Researchers observed that cybercriminals behind this campaign seemed to be particularly targeting people in Australia. Even though some people in the United States also received these emails, the offers were in Australian dollars, and Qantas is based in Australia.

This suggests the attackers preferred Australian victims. Moreover, they highlighted that the campaign successfully bypassed multiple Secure Email Gateways (SEGs), including Microsoft APT, Proofpoint, and Mimecast, indicating a sophisticated approach by the attackers.

This campaign started around February 2025 but seemed to slow down in mid-March 2025. It shows how criminals are constantly trying new and sophisticated ways to trick people online, making it important for everyone to be very careful about the emails they receive and the websites they visit.

Phishing Emails Impersonating Qantas Target Credit Card Info

Plus: France blames Russia for a series of cyberattacks, the US is taking steps to crack down on a gray market allegedly used by scammers, and Microsoft pushes the password one step closer to death.

Researchers unveiled a cluster of vulnerabilities in Apple’s wireless media streaming platform AirPlay this week that leave millions of third-party devices like speakers and TVs vulnerable to takeover if an attacker is on the same Wi-Fi network as the victim gadget. These “AirBorne” vulnerabilities have all been patched—including some that potentially impacted Apple’s Mac computers—but, in practice, third-party devices may not all get fixes, and even if they do, patch adoption could be low.

Records reviewed by WIRED show that utilizing car subscription features can substantially raise your risk of being subjected to government surveillance, because such services generate troves of data that are valuable to law enforcement. WIRED also did a deep dive on North Korea’s yearslong campaign to place IT workers inside companies in North American, the United Kingdom, and Europe. The schemes are more effective than ever as scammers incorporate AI into their workflows.

WhatsApp designed a special cloud processing platform called Private Processing to allow new AI tools to work in the secure messenger without compromising its end-to-end encryption. Experts warn, though, that it could create enticing targets for hackers. And we have a guide for navigating the privacy risks of using ChatGPT’s new image generator to do seemingly fun and innocuous projects like making an action figure version of yourself.

But wait, there's more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Three British Retailers Hacked in Spate of Cyberattacks**

Three separate retailers in the UK—including the supermarket Co-op and thedepartment stores Marks & Spencer and Harrods—have all revealed they have recently been subject to cyberattacks, with the intrusions and widespread impact seemingly ongoing. Toward the end of April, Marks & Spencer revealed it had been the victim of a “cyber incident.” Over the following two weeks, it has been forced to pause online orders within its apps, some food has been missing from its shelves, and it has paused recruitment and other “normal processes.” Staff at Co-op have been told to keep webcams turned on during remote meetings and check who is attending calls, after shutting down parts of its IT systems in response to its own hack. Harrods, meanwhile, told customers to “not do anything differently at this point.”

At the time of writing, none of the retailers have detailed the specific nature of the cyberattacks or the full scale of the impacts. It is also unclear if the attacks are linked. Bloomberg has reported a ransomware cartel dubbed DragonForce has claimed it and its partners were behind the attacks. The so-called cartel provides “infrastructure and tools” to hackers but “doesn't require affiliates to deploy its ransomware,” according to research from security firm Secureworks. The hacked companies did not respond to Bloomberg about the claims.

Bleeping Computer originally reported that the threat actors known as Scattered Spider were allegedly behind the attack on Marks & Spencer. The publication reported that the company’s servers were encrypted by ransomware, with the intrusion beginning as early as February. The attribution to Scattered Spider has not been confirmed by Marks & Spencer.

Over the past two years, Scattered Spider has emerged as one of the most prolific and dangerous sets of hackers currently operating. The threat actors are not a well-defined group of hackers. Instead, they’re more a loose collective that uses social engineering—such as phishing and voice calls—to gain initial access into company networks. Scattered Spider members are often English-speaking, teenaged, and can be members of the heinous criminal group the Com. The hackers have been active since June 2022 and have targeted more than 100 companies—including the high-profile hacks on Caesar's Entertainment and MGM Resorts in 2023.

**France (Finally) Names Russian Hackers for the First Time**

French authorities have condemned Russia’s military intelligence agency, accusing it of orchestrating a series of high-profile cyberattacks—including the hacking of Emmanuel Macron’s 2017 presidential campaign, a brazen 2015 assault on the TV channel TV5 Monde, and recent intrusion attempts targeting organizations involved in preparing the 2024 Paris Olympic Games.

French authorities have also disclosed the name and location of a GRU unit tied to the notorious hacking group APT28—information that had never before been officially released. Unit 20728 is based in the southern Russian city of Rostov-on-Don and operates out of the "166th Information Research Center."

This marks the first time French officials have publicly assigned blame to a foreign intelligence service following an internal attribution process. The timing is significant, coming as Paris positions itself at the forefront of Europe’s support for Ukraine.

**US Moves to Crack Down on ‘Largest Illicit Marketplace’**

The Trump administration has taken the first step toward blacklisting a Cambodian financial conglomerate at the center of a global money laundering network. On Thursday, the Treasury Department designated Huione Group as a money-laundering operation, alleging that the company and its affiliates have laundered more than $4 billion for criminals, including North Korean hackers and online scammers.

These scammers—who defraud victims through bogus investments and other schemes—rely on Huione and its affiliates to move funds abroad to evade both law enforcement and anti-money-laundering systems. The proposed action represents the most significant effort yet to crack down on Huione, which is tied to what experts believe to be the “largest illicit marketplace”: Huione Guarantee. According to WIRED’s January report, the marketplace has likely facilitated over $24 billion in gray-market transactions. Experts believe the platform operates as a one-stop shop for scammers, offering everything from victim contact lists and deepfake tools to fake investment websites and other illicit services.

**New Microsoft Accounts Won’t Need Passwords Anymore**

Slowly but surely, the password is dying. Over the past two years, passkeys—a stronger method of authentication that doesn’t require you to remember or use a password—have become more common. The rollout of the technology has been piecemeal, but big tech companies have worked for years to create the alternative, which is more secure than passwords. This week, Microsoft announced that people setting up new accounts with the company won’t have to create passwords at all. “New Microsoft accounts will now be ‘passwordless by default,’” the company wrote in a blog post. Microsoft is also pushing people further away from passwords and will “detect” the best way for people to lo in to their accounts if they have set up alternatives to passwords.

Hacking Spree Hits UK Retail Giants

A photo taken this week showed Mike Waltz using an app that looks like—but is not—Signal to communicate with top officials. "I don't even know where to start with this," says one expert.

On ThursdaY, Reuters published a photo depicting then-United States national security adviser Mike Waltz checking his phone during a cabinet meeting held by President Trump in the White House. If you enlarge the portion of the image that captures Waltz’s screen, it seems to show him using the end-to-end encrypted messaging app Signal. But if you look more closely, a notification on the screen refers to the app as “TM SGNL.” During a White House cabinet meeting on Wednesday, then, Waltz was apparently using an Israeli-made app called TeleMessage Signal to message with people who appear to be top US officials, including JD Vance, Marco Rubio, and Tulsi Gabbard.

After senior Trump administration cabinet members used vanishing Signal messages to coordinate March military strikes in Yemen—and accidentally included the editor in chief of The Atlantic in the group chat—the “SignalGate” scandal highlighted concerning breaches of traditional government “operational security” protocol as well as compliance issues with federal records-retention laws. At the center of the debacle was Waltz, who was ousted by Trump as US national security adviser on Thursday. Waltz created the “Houthi PC Small Group” chat and was the member who added top Atlantic editor Jeffrey Goldberg. "I take full responsibility. I built the group," Waltz told Fox News in late March. "We've got the best technical minds looking at how this happened," he added at the time.

SignalGate had nothing to do with Signal. The app was functioning normally and was simply being used at an inappropriate time for an incredibly sensitive discussion that should have been carried out on special-purpose, hardened federal devices and software platforms. If you're going to flout the protocols, though, Signal is (relatively speaking) a good place to do it, because the app is designed so only the senders and receivers of messages in a group chat can read them. And the app is built to collect as little information as possible about its users and their associates. This means that if US government officials were chatting on the app, spies or malicious hackers could only access their communications by directly compromising participants' devices—a challenge that is potentially surmountable but at least limits possible access points. Using an app like TeleMessage Signal, though, presumably in an attempt to comply with data retention requirements, opens up numerous other paths for adversaries to access messages.

"I don't even know where to start with this," says Jake Williams, a former NSA hacker and vice president of research and development at Hunter Strategy. “It's mind-blowing that the federal government is using Israeli tech to route extremely sensitive data for archival purposes. You just know that someone is grabbing a copy of that data. Even if TeleMessage isn't willingly giving it up, they have just become one of the biggest nation-state targets out there.”

TeleMessage was founded in Israel in 1999 by former Israel Defense Forces technologists and run out of the country until it was acquired last year by the US-based digital communications archiving company Smarsh. The service creates duplicates of communication apps that are outfitted with a “mobile archiver” tool to record and store messages sent through the app.

“Capture, archive and monitor mobile communication: SMS, MMS, Voice Calls, WhatsApp, WeChat, Telegram & Signal,” TeleMessage says on its website. For Signal it adds, “Record and capture Signal calls, texts, multimedia and files on corporate-issued and employee BYOD phones.” (BYOD stands for bring your own device.) In other words, there are TeleMessage versions of Signal for essentially any mainstream consumer device. The company says that using TeleMessage Signal, users can “Maintain all Signal app features and functionality as well as the Signal encryption,” adding that the app provides “End-to-End encryption from the mobile phone through to the corporate archive.” The existence of “the corporate archive,” though, undermines the privacy and security of the end-to-end encryption scheme.

TeleMessage apps are not approved for use under the US government's Federal Risk and Authorization Management Program or FedRAMP. TeleMessage and Smarsh did not immediately return requests for comment about whether their products are used by the US federal government and in what capacity.

"As we have said many times, Signal is an approved app for government use and is loaded on government phones,” White House press secretary Anna Kelly tells WIRED. She did not answer questions about whether the White House approves of federal officials using TeleMessage Signal—which is a different app from Signal—or whether other officials aside from Waltz have used the app or currently use it.

The Cybersecurity and Infrastructure Security Agency does not create policy around federal technology use but does release public guidance. When asked about Waltz’s apparent use of TeleMessage Signal, CISA simply referred WIRED to its best-practices guide for mobile communications. The document specifically advises, “When selecting an end-to-end encrypted messaging app, evaluate the extent to which the app and associated services collect and store metadata.”

It is not clear when Waltz started using TeleMessage Signal and whether he was already using it during SignalGate or started using it afterward in response to criticisms that turning on Signal's disappearing messages feature is in conflict with federal data-retention laws.

“I have no doubt the leadership of the US national security apparatus ran this software through a full information-assurance process to ensure there was no information leakage to foreign nations,” says Johns Hopkins cryptographer Matt Green. “Because if they didn’t, we are screwed.”

Tag

#sap