The Take It Down Act requires platforms to remove instances of “intimate visual depiction” within two days. Free speech advocates warn it could be weaponized to fuel censorship.

US President Donald Trump signed into law legislation on Monday nicknamed the Take It Down Act, which requires platforms to remove nonconsensual instances of “intimate visual depiction” within 48 hours of receiving a request. Companies that take longer or don’t comply at all could be subject to penalties of roughly $50,000 per violation.

The law received support from tech firms like Google, Meta, and Microsoft and will go into effect within the next year. Enforcement will be left up to the Federal Trade Commission, which has the power to penalize companies for what it deems unfair and deceptive business practices. Other countries, including India, have enacted similar regulations requiring swift removals of sexually explicit photos or deepfakes. Delays can lead to content spreading uncontrollably across the web; Microsoft, for example, took months to act in one high-profile case.

But free speech advocates are concerned that a lack of guardrails in the Take It Down Act could allow bad actors to weaponize the policy to force tech companies to unjustly censor online content. The new law is modeled on the Digital Millennium Copyright Act, which requires internet service providers to expeditiously remove material that someone claims is infringing on their copyright. Companies can be held financially liable for ignoring valid requests, which has motivated many firms to err on the side of caution and preemptively remove content before a copyright dispute has been resolved.

For years, fraudsters have abused the DMCA takedown process to get content censored for reasons that have nothing to do with copyright infringements. In some cases, the information is unflattering or belongs to industry competitors that they want to harm. The DMCA does include provisions that allow fraudsters to be held financially liable when they make false claims. Last year, for example, Google secured a default judgment against two individuals accused of orchestrating a scheme to suppress competitors in the T-shirt industry by filing frivolous requests to remove hundreds of thousands of search results.

Fraudsters who may have feared the penalties of abusing DMCA could find Take It Down a less risky pathway. The Take It Down Act doesn’t include a robust deterrence provision, requiring only that takedown requestors exercise “good faith,” without specifying penalties for acting in bad faith. Unlike the DMCA, the new law also doesn’t outline an appeals process for alleged perpetrators to challenge what they consider erroneous removals. Critics of the regulation say it should have exempted certain content, including material that can be viewed as being in the public’s interest to remain online.

Another concern is that the 48-hour deadline specified in the Take It Down Act may limit how much companies can vet requests before making a decision about whether to approve them. Free speech groups contend that could lead to the erasure of content well beyond nonconsensual “visually intimate depictions,” and invite abuse by the same kinds of fraudsters who took advantage of the DMCA.

Since it receives millions of DMCA takedown requests annually, Google has said in court papers that it “often must rely” on the “accuracy of the statements submitted by copyright claimants.” It’s difficult to imagine that the process would be any different for Take It Down, says Becca Branum, deputy director of the free expression project at the Center for Democracy and Technology. (CDT receives a minority of its funding from Google and other tech companies.)

“Platforms have no incentive or requirement to make sure what comes through the system is nonconsensual intimate imagery,” Branum says. Because it’s often cheaper and easier for companies to comply with requests than to investigate them, she says, more content may be removed from the internet than deserves to be. Braum points to another set of laws passed by Congress about seven years ago addressing sex trafficking content, which she argues also led to the removal of unrelated information from the web.

Under their existing takedown processes for nonconsensual intimate imagery, some tech companies require requestors to show government-issued identification confirming that they are the person being depicted. But advocates for victims say the rules unfairly burden legitimate requestors and jeopardize their privacy.

Take It Down doesn’t require identity verification, and it’s possible that burdensome processes to request removals could trigger FTC scrutiny. Likewise, critics of Take It Down also may call on the FTC—which is typically aligned with the president’s political party—to investigate companies that allow bogus requests to sail through.

Ted Cruz and Amy Klobuchar, the bipartisan pair of senators who helped shepherd Take It Down through Congress with little opposition, didn’t respond to requests for comment about issues that have been raised with the legislation. For members of Congress, passing the bill was imperative to protecting people, like the teenagers whose experiences helped shape it. The hope is that future victims will get their privacy back without delay.

Trump Signs Controversial Law Targeting Nonconsensual Sexual Content

Sequoia Capital partner Shaun Maguire said in a webinar hosted by Israel’s Defense Ministry that he connected the IDF with SpaceX’s Starlink satellite internet far sooner than believed.

Prominent Silicon Valley venture capitalist Shaun Maguire said on a webinar last week that he personally facilitated getting the Israel Defense Forces access to Starlink satellite internet, which is operated by Elon Musk’s SpaceX, within hours or days of it beginning its military response in Gaza to Hamas’ attack on October 7, 2023—far earlier than either Israel, Musk, or SpaceX have publicly acknowledged.

The topic was initially broached by Tel Aviv–based venture capitalist Aviv Eyal, who was introducing Maguire at the beginning of the May 14 webinar titled “Why VCs Are Betting On Defense Tech." The webinar was hosted by the Israeli Defense Ministry's “Mafat for Startups,” a defense startup investment program run by its Directorate of Defense Research & Development.

It is unclear exactly when Starlink was activated for IDF use, even according to Eyal and Maguire’s recollections. Eyal initially claimed on the webinar that it took Maguire “12 hours, maybe less, to get Starlink switched on over Israel.” Maguire added that he believed Eyal contacted him some time between October 8 and October 9; later on the webinar, Maguire said that he brought Starlink to the IDF on October 9. Israel would not officially approve of SpaceX’s limited use in the country until more than four months later. It also appears that SpaceX did not have a contractual agreement with the Pentagon at the time it began providing Starlink to the IDF, which the Pentagon required before SpaceX could provide Starlink to Ukraine. The Pentagon did not respond to WIRED’s request for comment.

“There's always the most kind of chaos and opportunity in the immediate aftermath after a catastrophe like that,” Maguire said on the webinar.

Eyal also said that Maguire, who has invested in SpaceX, introduced him to the head of country licensing of Starlink at SpaceX, and “really helped shepherd us through the first couple of months of getting Starlink into the hands of the IDF.”

“And it went on to be an absolute game changer and a huge success,” Eyal said.

Eyal is the cofounder and managing partner of the venture capital firm Entrée Capital. It’s unclear what Eyal’s relationship with the IDF was at the time he reached out to Maguire. However, Maguire noted on the webinar that, in the initial days after the attack, both he and Eyal, “in our own ways, started getting involved and trying to help Israel just in the immediate aftermath.”

Maguire did not respond for comment. When reached by WIRED, Eyal said that his reply was off the record, a condition WIRED did not agree to. He said that the webinar “was held ‘off the record’ and stated as such at the start of the webinar.” However, this was not stated during the webinar nor in the event description.

“You misunderstood the conversion, and as such your questions are not on topic and any conclusions you draw and write will unfortunately be incorrect and just an embarrassment,” Eyal said in his message. “Shaun's role is incorrect, and the dates you quote are incorrect as well as other key info.”

Eyal did not reply to two follow-up messages that contained quotes from the webinar and offered Eyal the opportunity to correct or clarify anything that was said.

On October 20, 2023, the IDF launched an offensive in Gaza that specifically targeted the territory’s internet and telecommunications infrastructure. This resulted in a “complete disruption” of internet and cellular communication for the then 2.3 million people living there.

A few days later, Elon Musk began what would reportedly become tense negotiations with the Israeli Communications Ministry to provide Starlink access in the area. On October 28, Musk said on X that Starlink would “support connectivity to internationally recognized aid organizations in Gaza” in a reply to US representative Alexandria Ocasio-Cortez drawing attention to the communications blackout.

Israeli communications minister Shlomo Karhi, in a quote-post of Musk, said that Israel would “use all means at its disposal to fight this,” claiming that Hamas would find a way to access and use Starlink for “terrorist activities.”

“Perhaps Musk would be willing to condition it with the release of our abducted babies, sons, daughters, elderly people,” Karhi wrote. “All of them! By then, my office will cut any ties with starlink.”

Musk replied a few hours later, saying, “We are not so naive.”

“Per my post, no Starlink terminal has attempted to connect from Gaza,” Musk added. “If one does, we will take extraordinary measures to confirm that it is used \*only\* for purely humanitarian reasons. Moreover, we will do a security check with both the US and Israeli governments before turning on even a single terminal.”

The Israeli Communications Ministry did not approve any use of Starlink in Israel or Gaza until February 14, 2024. At that point, Kahri said in a post on X, Starlink could be used both in Israel and at a United Arab Emirates–run field hospital in Rafah.

“The use of the company's services will be limited at first with broader use expected in the future,” Kahri said in the post.

Eyal mentioned on the webinar that it is currently "a matter of weeks” before Starlink is “launched for Israel as a whole” and available to any person or business. It is unclear if this access will include the occupied West Bank and Gaza.

SpaceX, the IDF, and the Israeli Communications Ministry did not respond for comment.

According to Agence France-Presse, 1,189 Israelis died as a result of Hamas’ October 7 attack on Israel. Hamas also took 251 Israelis to Gaza as hostages, of which 58 remain, and 23 are believed to be alive.

Between 53,000 and 62,000 Palestinians have died as a result of Israel’s military offensive into Gaza that followed October 7, according to Gaza’s Ministry of Health and Government Media Office. The exact death toll is unclear, because there is an unknown number of bodies buried under the rubble of destroyed buildings. Israel has blocked any food or medical aid entering Gaza since the beginning of March, which aid workers say have resulted in increasingly catastrophic and dire living conditions.

A Silicon Valley VC Says He Got the IDF Starlink Access Within Days of October 7 Attack

WIRED loves a rogue. Except rogues ruined the internet. Is there any salvaging the rebellious spirit without destroying everything?

At WIRED, we’ve had a long-running obsession with rogues. This is, after all, a publication that was founded in the early ’90s, born of a desire to champion the subversive, disruptive advent of the internet—and the hackers, hustlers, and blue-sky lunatics consumed by the possibilities of a digitized and interconnected planet.

Of course, WIRED had no idea, then, just what those rogues would ultimately unleash: a proliferation of bad actors wreaking havoc across the web; a booming industry of online conspiracy theorists whose dangerous convictions threaten everything from the health of our children to the strength of our democracies; and a coterie of tech billionaires with checkbooks and megaphones that reach from Silicon Valley all the way to the White House. Yes, rogues built the internet and inspired a technological revolution. Now, a mutated and much more powerful version of that same lawless spirit threatens to undo much of the incredible progress that technology and scientific inquiry have unlocked. DOGE Boys: I’m looking at you.

In this edition of WIRED, we’re finding plenty of ways to show you just how roguish, how crooked, and how precarious our world has become. Matt Burgess brings you the inside story of Nigeria’s Yahoo Boys and the “scam influencer” teaching them how to pull sophisticated digital cons on American victims. From Andy Greenberg, a timeline of ghost guns culminating in the one that Luigi Mangione allegedly used to murder a health care CEO in broad daylight—an act that’s turned Mangione into the internet’s most beloved rogue in recent memory. (Scroll down to watch what happened when Andy tried to re-create that weapon himself.) And from Evan Ratliff, the sweeping, bone-chilling saga of the Zizians, a group of gifted young technologists who became the world’s first AI-inflected death cult and allegedly killed six people over several violent, chaotic years.

Scam influencers? DIY guns? AI death cults? Yes, things are rough out there. But we wouldn’t be WIRED without finding—and even creating—a little bit of roguish fun amid the gloom. Elsewhere in this issue, we’ll introduce you to a new and inspiring era of anti-establishment rebellion that’s taking root: Amber Scorah, the cofounder of a nonprofit that helps whistleblowers safely share information with the masses, is one such example. Another is Bluesky CEO Jay Graber, who sat down with Kate Knibbs to elaborate on her vision for a democratized social internet. Plus, our Gear experts will show you the slickest, most villainous products to outfit your supervillain lair.

If you take one thing from our Rogues Issue, I hope it’s this: “Rogue” is by no means a pejorative—even if it feels like more nasty bad actors than ever, perched in the highest seats of power, are running roughshod over pretty much everything. In fact, I’d argue that this moment calls for more rogues rather than fewer. The idealistic rogues. The indefatigable rogues. The new iteration of blue-sky lunatics who can imagine what a better world should look like—and are willing to fight the status quo to get us there. So be the rogue you want to see in the world, and know that WIRED, with every ounce of rebel spirit in our DNA, will be right there with you.

Who Even Is a Criminal Now?

In the wake of Luigi Mangione’s alleged killing of a health care CEO with a partially 3D-printed pistol, we built the exact same weapon ourselves—and test-fired it.

We 3D-Printed Luigi Mangione’s Ghost Gun. It Was Entirely Legal

Amber Scorah and Psst are building a “digital safe” to help people shine a light on the bad things their bosses are doing, without getting found out.

Amber Scorah knows only too well that powerful stories can change society—and that powerful organizations will try to undermine those who tell them. In 2015, her 3-month-old son Karl died on his first day of day care. Heartbroken and furious that she hadn’t been with him, Scorah wrote an op-ed about the poor provision for parental leave in the US; her story helped New York City employees win their fight for improved family leave. In 2019 she wrote a memoir about leaving her tight-knit religion, the Jehovah’s Witnesses, that exposed issues within the secretive organization. The book cost her friends and family members, but she heard from many people who had also been questioning some of the religion’s controversial practices.

Then, while working at a media outlet that connects whistleblowers with journalists, she noticed parallels in the coercive tactics used by groups trying to suppress information. “There is a sort of playbook that powerful entities seem to use over and over again,” she says. “You expose something about the powerful, they try to discredit you, people in your community may ostracize you.”

In September 2024, Scorah cofounded Psst, a nonprofit that helps people in the tech industry or the government share information of public interest with extra protections—with lots of options for specifying how the information gets used and how anonymous a person stays.

Psst’s main offering is a “digital safe”—which users access through an anonymous end-to-end encrypted text box hosted on Psst.org, where they can enter a description of their concerns. (It accepts text entries only and not document uploads, to make it harder for organizations to find the source of leaks.)

To safely share secrets, tech whistleblowers can go to psst.org and enter details in an encrypted text-box.

Photograph: Ali Cherkis

What makes Psst unique is something it calls its “information escrow” system—users have the option to keep their submission private until someone else shares similar concerns about the same company or organization.

As the organization was preparing to launch, members of Psst’s team helped a group of Microsoft employees who were unhappy with how the company was marketing its AI products to fossil-fuel companies. Only one employee was willing to speak publicly, but others provided supporting documents anonymously. With help from Psst’s team of lawyers, the workers filed a complaint with the Securities and Exchange Commission against the company and aired their concerns in a story published by The Atlantic.

Combining reports from multiple sources defends against some of the isolating effects of whistleblowing and makes it harder for companies to write off a story as the grievance of a disgruntled employee, says Psst cofounder Jennifer Gibson. It also helps protect the identity of anonymous whistleblowers by making it harder to pinpoint the source of a leak. And it may allow more information to reach daylight, as it encourages people to share what they know even if they don’t have the full story.

Only members of Psst’s in-house legal team can access information in the safe. In countries including the US and UK, communications between lawyers and their clients usually benefit from legal privilege, meaning the information is kept confidential.

This is one reason tech companies have such large legal departments, says Gibson, who leads Psst’s in-house legal team: “They’re designed to put lawyers in the room so the information isn’t disclosable. To some extent, we’re using their playbook.”

Amber Scorah with Psst co-founders Jennifer Gibson and Rebecca Petras.

Photograph: Ali Cherkis

At the moment, Psst lawyers first manually review the entries in the safe without reading the contents. Users can tag their entries with the company name and the category of their concern—“trust and safety” or “fraud,” for instance. If the lawyers find matches, and the contributor consents, the lawyers decrypt and read the entries to see if they may form part of the same story, while keeping the different contributors’ identities protected from one another.

Psst plans to automate some of this process—in the future an algorithm running in a secure enclave built into the hardware of a computer will decrypt and compare information looking for potential matches while keeping it shielded from human eyes.

What happens next depends on various factors, but often Psst will involve an independent investigative journalist or publish accounts on its own website. Sometimes, whistleblowers might want to alert regulators without going public.

One challenge, Gibson says, is that regulation often lags behind technological advances, as with AI safety. “You’re then in this no-man’s-land,” she says—even if something’s not illegal, reporting it may be in the public interest.

Scorah hopes Psst’s impact on the tech world will be similar to what she experienced when telling her own stories, by using insiders’ accounts to shed light on broader industry issues. “Whether it’s a religion operating off the radar with policies that cause harm or an AI company whose product or policies are causing harm, I have seen the same thing,” she says. “Sunlight has a sanitizing effect.”

For Tech Whistleblowers, There’s Safety in Numbers

Format Boy makes a living teaching Yahoo Boys, notorious West African scammers, how to use AI and deepfake technology to ensnare their next victims.

As soon as Format Boy answers the phone, I recognize his booming voice. I’ve spent weeks immersed in the influencer’s back catalog of videos and voice notes. Format Boy isn’t like other influencers: He doesn’t show his face, and he won’t tell me his real name. He isn’t posting motivational content or seeking lucrative brand deals. Instead, he’s teaching his audience how to orchestrate high-paying online scams.

Format Boy—as he styles himself on YouTube, Telegram, Instagram, and X, where he has amassed thousands of followers and racked up hundreds of thousands of views—acts as an unofficial adviser to a collective of menacing West African fraudsters known as the Yahoo Boys.

Typically these cybercriminals, mostly young men, work from their phones or laptops to con wealthy foreigners—often Americans—out of their life savings. Some have started using face-swapping and deepfakes to enhance their grifts. In one recent development, Yahoo Boys posted fake CNN broadcasts with AI-generated newscasters designed to trick people they’re blackmailing into thinking they’ve been outed on the news.

Often based in Nigeria, Yahoo Boys build elaborate relationships with their victims over weeks or months before they extract whatever cash they can. They’re not the most technically sophisticated scammers, but they’re agile and skillful social engineers. Victims in the US, UK, and elsewhere have lost millions to Yahoo Boys in recent years, and multiple teenage boys have reportedly taken their own lives after being blackmailed and sextorted by them.

Yahoo Boys have their own terminology—a code of sorts—that helps them run scams (and potentially avoid social media moderation teams). Victims are called “clients.” “Bombing” involves messaging hundreds of online accounts to see if someone responds. Scams are known as “formats” (hence the name Format Boy). And there are formats for all occasions. Romance and dating formats try to get people to fall in love; cops and FBI officials are mimicked in impersonation scams; Elon Musk formats pretend to be the centibillionaire. There are investment scams, gift card scams, the list goes on. Hundreds of scripts, which can be copied and pasted directly to a victim, float around the internet. One is called “50 Questions to Ask Your Client as a Yahoo Boy.”

There’s a whole hustle culture surrounding the Yahoo Boys. They pose with luxury cars and wear elaborate jewelry. On social media, hundreds of pages and groups, often explicitly using “Yahoo” in their names, claim to mentor newcomers, teach them the skills they need to con people, and provide them with the tools to do so.

Format Boy is one of the more prominent, or at least obvious, of these “scamfluencers”—his posts are often flagged by cybersecurity researchers who track the Yahoo Boys.

“I’m going to be teaching you guys exactly how to make a fake video call in this video,” Format Boy says at the start of his most popular YouTube video. Dramatic music blares as a deepfake video call is made onscreen. A brief text banner says it’s for educational purposes only. Six of Format Boy’s most popular videos, in fact, are all about creating deepfakes, with others detailing how Yahoo Boy scams work. “Fake video calls are very important,” he says in a voice note on Telegram. “Sometimes your clients cannot release some information to you without seeing you physically, without seeing you on camera.”

Illustration: Manuel Cetin

Format Boy started working around 2019, using a cheap phone to spam potential victims on dating sites. From there he got into the business of teaching people his methods and selling them software, guides, and tools. But on the phone with me, Format Boy is quick to distance himself from scamming. “It’s not something I really do personally,” he says, a claim he repeats multiple times, although he concedes he has at least some hands-on experience. “At some point I was doing it, but I eventually stopped, and I started doing … I went into video editing and AI research,” he says.

He complains that over the past three years YouTube has removed his channels multiple times, resetting his follower count on each occasion. When pushed, he admits that what he posts online could help people to break the law. “I won’t lie to you. That’s the truth; it’s encouraging them,” he says. He’s most active on his Telegram channel where he regularly sends messages and rambling voice notes—some up to nine minutes long—to his 15,000 subscribers. His posts give advice on things like how to build up trust with a “client” to gain access to their bank accounts, and recommendations and offers for AI software that Yahoo Boys can use to change their appearance on video calls with potential victims. In one post, he touts a Valentine’s Day promotional offer on this deepfake software—reduced from 60,000 Nigerian Naira (about $38) to 15,000 ($9.50).

I ask Format Boy how he feels about the impact Yahoo Boys have on their victims. He emphasizes his professional restraint. “I don’t teach them everything—even if they pay for it—because I feel like this is not the right thing to do normally,” he says. Many people in Nigeria feel that they have little help from the government, he adds. “This is why I teach, just so that they can know that even if they’re in the worst place in life, they can try something different for a while.”

In many of his voice notes on Telegram, Format Boy strikes an optimistic tone. Time is short, he says. Scammers need “determination” to succeed. “If you don’t plan well, you will fail well. If you plan well, you will succeed well,” he says in one voice note. “When I am giving you guys assignments,” he says in another, “I am not trying to play teacher. I’m trying to push you to your next level.”

Format Boy, like any influencer, is subject to the vicissitudes of the algorithm. Over the years he has begged for more engagement on his YouTube videos. In voice notes from December 2023, he said someone was pretending to be Format Boy online and had created false accounts. In another from early 2024, he said: “I feel like the stress on YouTube, all these platforms, is too much. I’m resigning.” Three days after quitting, he was back posting. But recently, he’s been planning his new hustle. His latest move, he tells me, is trading memecoins.

How to Win Followers and Scamfluence People

The company behind the Signal clone used by at least one Trump administration official was breached earlier this month. The hacker says they got in thanks to a basic misconfiguration.

During a recent cabinet meeting, President Donald Trump’s then national security adviser, Mike Waltz, must have been bored. Apparently unaware of the photographer behind him, he was caught clandestinely checking his Signal messages under the table.

Only he wasn’t using the official Signal app, which is widely considered to be the gold standard of encrypted messaging apps. He was actually using a clone of Signal called TeleMessage Signal, or TM SGNL. This app, made by TeleMessage (which was recently acquired by Smarsh), works in almost exactly the same way as Signal, except that it also archives copies of all the messages passing through it, shattering all of its security guarantees.

Two days after the photo of Waltz was published, an anonymous source told me that they had hacked TeleMessage. “I would say the whole process took about 15 to 20 minutes,” the hacker said, as Joseph Cox and I reported in 404 Media. “It wasn’t much effort at all.” Representatives from TeleMessage and Smarsh did not respond to a request for comment.

The exploit that the hacker used was incredibly simple. At the time, we chose not to publish any details about it because it would be so easy for others to replicate. Since then, TeleMessage has temporarily suspended all services, which is now why WIRED can share exactly how this hack took place without risking anyone’s private data.

“I first looked at the admin panel **secure.telemessage.com** and noticed that they were hashing passwords to MD5 on the client side, something that negates the security benefits of hashing passwords, as the hash effectively becomes the password,” the hacker said. (Hashing is a way of cryptographically obfuscating a password stored on a system, and MD5 is an inadequate version of the algorithms used to do so.) Drop Site News has since reported that it appears that this admin panel exposed email addresses, passwords, usernames, and phone numbers to the public.

The weak password hashing, and the fact that the TeleMessage site was programmed with JSP—an early 2000s-era technology for creating web apps in Java—gave the hacker “the impression that their security must be poor.” Hoping to find vulnerable JSP files, the hacker then used feroxbuster, a tool that can quickly find publicly available resources on a website, on **secure.telemessage.com**.

The hacker also used feroxbuster on **archive.telemessage.com**, another domain used by TeleMessage, which is where they discovered the vulnerable URL, which ended in **/heapdump**.

When they loaded this URL, the server responded with a Java heap dump, which is a roughly 150-MB file containing a snapshot of the server’s memory at the moment the URL was loaded.

The hacker said they “knew from past experience that heap dumps from web servers” will include the “bodies” of http requests, they said, “and this may include credentials of users logging in.” And for TM SGNL, they did. By downloading a heap dump and then searching for “password,” the hacker could see usernames and passwords of random users.

They tried logging into **secure.telemessage.com** using a pair of these credentials and discovered that they had just hacked a user with an email address associated with US Customs and Border Protection, one of the agencies implementing Trump’s draconian immigration policy. CBP has since confirmed that it was a TeleMessage customer.

After spending a few more minutes digging through the heap dump, the hacker also discovered plaintext chat logs. “I can read Coinbase internal chats, this is incredible,” the hacker said. (Coinbase did not respond to WIRED's request for comment, but did tell 404 Media that “there is no evidence any sensitive Coinbase customer information was accessed or that any customer accounts are at risk, since Coinbase does not use this tool to share passwords, seed phrases, or other data needed to access accounts.”)

At this point, the hacker says they had spent 15 to 20 minutes poking at TeleMessage’s servers, and had already compromised one of their federal government customers, along with one of the world’s biggest cryptocurrency exchanges.

As I discovered from analyzing TM SGNL’s source code, TeleMessage apps—like the one running on Mike Waltz’s phone—uploaded unencrypted messages to **archive.telemessage.com** (I call this the archive server), which then forwards the messages to the customer’s final destination. This contradicts TeleMessage’s public marketing material, where they claimed TM SNGL uses “end-to-end encryption from the mobile phone through to the corporate archive.”

The archive server is programmed in Java and is built using Spring Boot, an open source framework for creating Java applications. Spring Boot includes a set of features called Actuator that helps developers monitor and debug their applications. One of these features is the heap dump endpoint, which is the URL the hacker used to download heap dumps.

According to Spring Boot Actuator’s documentation: “Since Endpoints may contain sensitive information, careful consideration should be given about when to expose them.” In the case of TeleMessage’s archive server, the heap dumps contained usernames, passwords, unencrypted chat logs, encryption keys, and other sensitive information.

If anyone on the internet had loaded the heap dump URL right as Mike Waltz was texting using the TM SGNL app, the heap dump file would have contained his unencrypted Signal messages, too.

A 2024 post on the cloud security company Wiz’s blog lists “Exposed HeapDump file” as the number one common misconfiguration in Spring Boot Actuator. “Up until version 1.5 (released in 2017), the /heapdump endpoint was configured as publicly exposed and accessible without authentication by default. Since then, in later versions Spring Boot Actuator has changed its default configuration to expose only the /health and /info endpoints without authentication (these are less interesting for attackers),” the author wrote. “Despite this improvement, developers often disable these security measures for diagnostic purposes when deploying applications to test environments, and this seemingly small configuration change may remain unnoticed and thereby persist when an application is pushed to production, inadvertently allowing attackers to obtain unauthorized access to critical data.”

In a 2020 post on Walmart’s Global Tech Blog, another developer gave a similar warning. “Apart from /health and /info, all actuator endpoints are risky to open to end users because they can expose application dumps, logs, configuration data and controls,” the author wrote. “The actuator endpoints have security implications and SHOULD NEVER EVER be exposed in production environment.”

The hacker’s quick exploit of TeleMessage indicates that the archive server was badly misconfigured. It was either running an eight-year-old version of Spring Boot, or someone had manually configured it to expose the heap dump endpoint to the public internet.

This is why it took a hacker about 20 minutes of prodding before it cracked open, with sensitive data spilling out.

Despite this critical vulnerability and other security issues with TeleMessage’s products—most notably, that the Israeli firm that builds the products can access all its customer’s chat logs in plaintext—someone in the Trump administration deployed it to Mike Waltz’s phone while he was serving as national security adviser.

How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes

Plus: 12 more people are indicted over a $263 million crypto heist, and a former FBI director is accused of threatening Donald Trump thanks to an Instagram post of seashells.

As analysts and governments around the world continue to call attention to North Korean digital fraud, researchers this week published 1,000 email addresses they claim are linked to North Korean IT worker scams perpetrated against Western companies, along with photos of people allegedly involved in the fraud. Xinbi Guarantee, a marketplace and platform used by Chinese-speaking crypto scammers for money laundering grew into an $8.4 billion hub before a crackdown by Telegram this week. And following a WIRED inquiry, messaging app Telegram banned thousands of accounts used for money laundering in cryptocurrency scams. The takedowns included prominent names like Haowang Guarantee, a black market known for enabling $27 billion in transactions.

The acting director of the Consumer Financial Protection Bureau, Russell Vought, quietly eliminated a plan to more tightly regulate the sale of Americans’ sensitive personal data. CFPB had originally launched the initiative in response to increasingly far reaching and reckless behavior from data brokers. And with the rise of widely available generative AI services—and corresponding fraud—people are increasingly looking for ways to verify and vet their digital interaction online.

Meanwhile, ahead of Google’s Android 16 launch next week, the company announced expanded capabilities for its Android Scam Detection tool that uses local AI analysis to flag potential scam texts in Google Messages. The company also launched a new, extra-secure mode for Android 16, Advanced Protection, that will allow vulnerable or highly targeted users to lock their devices down and utilize advanced scanning features for catching potentially suspicious activity.

But there's more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

**Coinbase Discloses Costly Data Breach Impacting Less Than 1 Percent of Monthly Users**

The cryptocurrency exchange Coinbase said this week that it suffered a data breach in which attackers stole data including customers’ names, physical and email addresses, phone numbers, government IDs like driver’s licenses and passports, last four digits of Social Security numbers, and other financial information. The company said that “criminals targeted our customer support agents overseas. They used cash offers to convince a small group of insiders to copy data in our customer support tools for less than 1 percent of Coinbase monthly transacting users.” The company said the attackers’ goal was to collect customer data to then contact those Coinbase users, impersonate Coinbase, and trick them into giving away their cryptocurrency. The attackers also contacted the company and attempted to extort the company for $20 million. Coinbase currently has about 9.7 million total users. The company said in an Securities and Exchange Commission breach disclosure notification that it expects that it will cost between $180 million and $400 million to remediate the breach and reimburse customers for stolen funds.

**12 More Indicted Over Crypto Heist Worth $263 Million**

A four-count superseding indictment charged 12 additional people this week in an alleged criminal spree including more than $263 million in cryptocurrency theft, money laundering, and even physical break-ins. Several suspects were arrested this week in California in connection with the case. The indictment accuses the defendants of using stolen cryptocurrency for things like $500,000 nights out at clubs, hundreds of thousands of dollars spent on luxury handbags, watches, and clothes, private jet rentals, and “a fleet of at least 28 exotic cars ranging in value from $100,000 to $3.8 million.” The superseding indictment also alleges that some defendants used shell companies to register their “exotic cars” and “shipped bulk cash through US mail to members of the enterprise hidden in squishmallow stuffed animals.”

**James Comey Investigated for Instagram Post of Seashells**

On Thursday, former FBI director James Comey posted and then deleted an Instagram photo of seashells arranged to spell out the numbers “8647” captioned: “Cool shell formation on my beach walk.” Within hours, Republicans fixated on the post, claiming it was a call to violence against Donald Trump, the United States’ 47th president. Now, the Department of Homeland Security and the Secret Service are investigating.

If you’ve ever worked in a restaurant, you’ve probably heard someone in the kitchen shout that an item is “86’d”—a colloquialism meaning the kitchen is out of a particular menu item, like a cheeseburger. While most people don’t interpret that as a threat of violence against the cheeseburger, that’s apparently not how the president and his allies understood Comey’s post.

On Thursday, Department of Homeland Security secretary Kristi Noem wrote on X that both the DHS and Secret Service were investigating. “Disgraced former FBI Director James Comey just called for the assassination of @POTUS Trump,” she wrote. Later that night on Fox News, Director of National Intelligence Tulsi Gabbard accused Comey of “issuing a hit” on Trump and argued he should be “put behind bars.”

"That meant assassination, and it says it loud and clear," Trump told Fox News in an interview referring to the post, on Friday. Trump survived two assassination attempts last year.

Comey addressed the backlash in a follow-up post on Instagram, writing: “I didn't realize some folks associate those numbers with violence. It never occurred to me, but I oppose violence of any kind, so I took the post down.”

Comey served as FBI director from 2013 until he was fired by President Trump in 2017 during an ongoing investigation into Russian interference in the 2016 election.

Coinbase Will Reimburse Customers Up to $400 Million After Data Breach

Following a WIRED inquiry, Telegram banned thousands of accounts used for crypto-scam money laundering, including those of Haowang Guarantee, a black market that enabled over $27 billion in transactions.

For years, a Chinese-language market for crypto scammers and money launderers—by some measures, the internet's biggest black market of all time—operated in plain sight on the messaging service Telegram, facilitating tens of billions of dollars in illicit finance. Now, thanks to the scrutiny of one team of crypto crime researchers and Telegram's ban hammer, it's gone.

Haowang Guarantee, the crypto-fueled crime bazaar more widely known by its original name, Huione Guarantee, declared in an announcement posted to its website sometime in the last 24 hours that it would be shutting down. The move comes in response to Telegram's action on Monday to ban thousands of accounts and usernames that served as the infrastructure for the sprawling marketplace of third-party vendors, many of whom provided money laundering and other services to the burgeoning industry of East Asian crypto scammers.

“Telegrame were blocked all of our NFT, Channels and group on May 13th 2025, Haowang Grarantee will cease operation from now,” the company wrote on its website in a short, typo-ridden statement in English, apparently using the acronym NFT to refer to the blockchain-based non-fungible tokens that serve as proof of ownership for certain Telegram usernames. “Thank you for your attention.”

Prior to its abrupt shutdown, Haowang Guarantee—which despite its rebrand was still partially owned by Huione Guarantee and its Cambodia-based parent company Huione Group—had allowed third-party vendors to sell a wide variety of services to crypto scammers, all via Telegram, using deposit and escrow systems to “guarantee” the transactions. Huione Guarantee merchants primarily offered money laundering via the cryptocurrency Tether, but they also sold other components of the crypto scam industry, ranging from potential victim data for targeting, telecommunications infrastructure, deepfake software, and even GPS-enabled collars and electric batons used to enslave workers in the scam compounds that have spread across Myanmar, Cambodia, and the Philippines.

Telegram's sudden move to ban the marketplace's accounts appears to have been spurred by WIRED's inquiry to Telegram late last week about new findings from researchers at the crypto-tracing firm Elliptic. Since July of last year, Elliptic has highlighted the enormous volume of money laundering and other illicit transactions taking place on Huione Guarantee and later Haowang Guarantee. By Elliptic's accounting in a January report, the market and its rebrand had facilitated more than $24 billion in total transactions, which would make it by far the largest single black market operation in the internet's history. That figure has since jumped to $27 billion, according to Elliptic.

Elliptic's latest findings concerned a second Telegram-based market known as Xinbi Guarantee, which offered a similar model of third-party transactions and had facilitated $8.4 billion in deals since 2022 that researchers say included not only money laundering for scammers, but also stolen data, harassment for hire, and apparent sex trafficking. When WIRED asked Telegram about Elliptic's findings regarding both markets, the company responded with broad bans of Xinbi Guarantee and Haowang Guarantee accounts.

“This is a huge win. The largest dark-net marketplace to have ever existed has been shut down,” says Elliptic cofounder Tom Robinson. “It's a game changer in terms of overall online criminal markets, and it's huge for victims of online fraud. This marketplace was a key enabler of the global scam epidemic, and I think this will put a real dent in the ability of online scammers to do what they do.”

In a statement sent to WIRED Monday, Telegram spokesperson Remi Vaughn wrote that “communities previously reported to us by WIRED or included in reports published by Elliptic have all been taken down,” and added that “criminal activities like scamming or money laundering are forbidden by Telegram's terms of service and are always removed whenever discovered.” Telegram declined to comment further following Haowang's announcement that it was going offline.

Although it wasn't mentioned in Vaughn's statement, Telegram's ban may have also been related to an announcement earlier this month from the US Treasury's Financial Crimes Enforcement Network that Huione Group, Huione Guarantee and Haowang Guarantee's parent company, would be added to a list of known money laundering operations in an attempt to limit its access to US financial institutions.

While Haowang Guarantee responded to Telegram's bans by almost immediately shutting down, Xinbi Guarantee appears to be making an effort to relaunch itself on new Telegram channels, Robinson says. Elliptic says that Haowang Guarantee's owners also own a stake in another similar Telegram-based market called Tudou Guarantee, according to a Telegram post from one of Haowang's administrators, and they may seek to rebuild their business there. Tudou Guarantee has already seen a significant surge in new users, Robinson says.

Whether the two markets succeed in relaunching, Robinson notes, will depend largely on how serious Telegram is about its efforts to prevent them from using its messaging services.

“Are they going to pursue all of these marketplaces and continue to do so as new ones emerge?” Robinson asks. “If so, I think that Telegram is no longer a realistic platform for these marketplaces, and they'll have to look for somewhere else to operate.” He suggests the crypto-scam market operators would then likely try to migrate to another messaging service with less oversight, or even a decentralized one where they can't be effectively banned.

Haowang, in particular, has powerful backing from a company with links to businesses associated with the Cambodian ruling family. Huione Guarantee's parent company, the Cambodian financial conglomerate Huione Group, includes a company linked to the family of Cambodia’s prime minister, Hun Manet. Hun To, the prime minister’s cousin, serves as one of those companies' directors—and has also been linked in an Al Jazeera investigation to an alleged scam compound.

All of that means Telegram's takedowns are by no means the end of the crypto-scam industry, says Robinson. They may, however, represent a serious setback for the markets that cash out its profits and launder its money.

“Online crime is a cat-and-mouse game in general. But these are very large mice,” Robinson says. “It's a big blow to the criminal ecosystem that will take a long time to recover from.”

The Internet’s Biggest-Ever Black Market Just Shut Down Amid a Telegram Purge

Russell Vought, acting director of the Consumer Financial Protection Bureau, has canceled plans to more tightly regulate the sale of Americans’ sensitive personal data.

The Consumer Financial Protection Bureau (CFPB) has canceled plans to introduce new rules designed to limit the ability of US data brokers to sell sensitive information about Americans, including financial data, credit history, and Social Security numbers.

The CFPB proposed the new rule in early December under former director Rohit Chopra, who said the changes were necessary to combat commercial surveillance practices that “threaten our personal safety and undermine America’s national security.”

The agency quietly withdrew the proposal on Tuesday morning, publishing a notice in the Federal Register declaring the rule no longer “necessary or appropriate.”

The CFPB received more than 600 comments from the public this year concerning the proposal, titled Protecting Americans from Harmful Data Broker Practices. The rule was crafted to ensure that data brokers obtain Americans’ consent before selling or sharing sensitive personal information, including financial data such as income. US credit agencies are already required to abide by such regulations under the Fair Credit Reporting Act, one of the nation’s oldest privacy laws.

In its notice, the CFPB’s acting director, Russell Vought, wrote that he was withdrawing the proposal “in light of updates to Bureau policies,” and that it did not align with the agency’s “current interpretation of the FCRA,” which he added the CFPB is “in the process of revising.”

The CFPB did not immediately respond to a request for comment.

Data brokers operate within a multibillion-dollar industry built on the collection and sale of detailed personal information—often without individuals’ knowledge or consent. These companies create extensive profiles on nearly every American, including highly sensitive data such as precise location history, political affiliations, and religious beliefs. This information is frequently resold for purposes ranging from marketing to law enforcement surveillance.

Many people are unaware that data brokers even exist, let alone that their personal information is being traded. In January, the Texas Attorney General’s Office, led by attorney general Ken Paxton, accused Arity—a data broker owned by Allstate—of unlawfully collecting, using, and selling driving data from over 45 million Americans to insurance companies without their consent.

The harms from data brokers can be severe–even violent. The Safety Net Project, part of the National Network to End Domestic Violence, warns that people-search websites, which compile information from data brokers, can serve as tools for abusers to track down information about their victims.

Last year, Gravy Analytics—which processes billions of location signals daily—suffered a data breach that may have exposed the movements of millions of individuals, including politicians and military personnel.

“Russell Vought is undoing years of painstaking, bipartisan work in order to prop up data brokers’ predatory, and profitable, surveillance of Americans,” says Sean Vitka, executive director of Demand Progress, a nonprofit that supported the rule. Added Vitka: “By withdrawing the CFPB’s data broker rulemaking, the Trump administration is ensuring that Americans will continue to be bombarded by scam texts, calls and emails, and that military members and their families can be targeted by spies and blackmailers.”

Vought, who also serves as director of the White House Office of Management and Budget, received a letter on Monday from the Financial Technology Association (FTA) calling for the rule to be withdrawn, claiming the rules exceed the agency’s statutory mandate and would be “harmful to financial institutions’ efforts to detect and prevent fraud.” The FTA is a US-based trade organization that represents the interests of fintech companies and their executives.

Privacy advocates have long pressed regulators to use the Fair Credit Reporting Act to crack down on the data broker industry. Common Defense, a veteran-led nonprofit, urged the CFPB to take action in November, blaming data brokers for recklessly exposing sensitive information about US service members that placed them at “substantial risk” of being blackmailed, scammed, or targeted by hostile foreign actors.

A 2023 study cited by the group—funded by the US Military Academy at West Point—concluded that the current data broker ecosystem is a threat to US national security, permitting the sale of sensitive personal data that can be used not only to identify service members and “other politically sensitive targets,” but also to offer details about medical conditions, financial problems, and political and religious beliefs. “Foreign and malign actors with access to these datasets could uncover information about high-level targets, such as military service members, that could be used for coercion, reputational damage, and blackmail,” the authors report.

Common Defense political director Naveed Shah, an Iraq War veteran, condemned the move to spike the proposed changes, accusing Vought of putting the profits of data brokers before the safety of millions of service members. "For the sake of military families and our national security, the administration must reverse course and ensure that these critical privacy protections are enacted," Shah says.

Investigations by WIRED have shown that data brokers have collected and made cheaply available information that can be used to reliably track the locations of American military and intelligence personnel overseas, including in and around sensitive installations where US nuclear weapons are reportedly stored.

WIRED reported in February that US data brokers were using Google's ad-tech tools to sell access to information about devices linked to military service members and national security decisionmakers, as well as federal contractors that manufacture and export classified defense-related technologies. Experts say it proves trivial for foreign adversaries to de-anonymize the data.

"Data brokers inflict severe harm on individuals by degrading privacy, threatening national security, enabling scams and fraud, endangering public officials and survivors of domestic violence, and putting immigrant populations at risk,” says Caroline Kraczon, law fellow at the Electronic Privacy Information Center focused on consumer protection.

“The CFPB had a critical opportunity to address these harms by clarifying that data brokers must follow the Fair Credit Reporting Act,” adds Kraczon. “This withdrawal is deeply disappointing and another attack in the administration’s war against consumers on behalf of corporate interests."

Last month, more than 1,400 CFPB employees had their positions at the agency terminated, leaving the agency with a staff of around 300 people. Elon Musk, whose so-called Department of Government Efficiency (DOGE) has spearheaded the White House's efforts to radically restructure the federal government by slashing the size of its workforce, last November called on President Donald Trump to “delete” the CFPB, whose job includes shielding Americans from predatory lending practices.

_Update 10 am ET, May 15, 2025: Clarified the types of companies represented by the Financial Technology Association._

Source

Wired