The provocative claims by cryptography researcher Darkhorse rekindled debate over whether Ripple Labs is quietly circumventing a federal court injunction through a $300 million XRP Treasury vehicle involving Asia-based mobility company Webus International Ltd.

“This new Treasury setup will allow @Ripple to bypass injunctions legally and cleanly,” Darkhorse declared in a June 4th post on X. He claims that Ripple has discovered “the only route left by the judge.” “It’s not just smart,” he wrote. “It’s based on design.”

The setup in question was revealed in a recent Form 6-K filing by Webus. This outlined the creation of the XRP Ministry of Finance, managed by Samara Alpha, a registered investment advisor. The program delegates Samara full control of XRP up to $300 million under a staged, regulated structure. The filing stops at stating where XRP comes from, but Darkhorse insists that the intention is clear. Ripple claims that XRP can legally be sold to intermediaries in sections like Samara.

Related readings

“Ripple is prohibited from direct institutional sales without SEC clearance,” explained Darkhorse. “The workaround is selling to a regulated intermediary (like Samara on behalf of Webus) with SEC transparent, non-retail financial contracts. It’s structured – not casual.”

Is Ripple bypassing the XRP injunction?

Veteran XRP commentator Jay Nisbett pushed back. “I don’t think any of this is clever or bypassing anything — it’s just an adoption,” he replied. Nisbett argued that Ripple and Webus are not partners, that Webus is just getting XRP, like other participants in the secondary market, and that the assets themselves are “deemed not security in this context.” He added that holding XRP on the balance sheet is not the same as triggering a securities transaction.

Darkhorse issued a sharp rebuttal. “You’re missing the mechanism,” he told Nisbet, laying out his arguments in four parts. First, he emphasized that Webus had not only announced its intention to purchase in the open market. “Webus, submitted via Form 6-K, has publicly released the $300 million XRP Treasury Department, but will not simply buy it in the open market. They delegated control to Samara Alpha, a SEC registered investment advisor, under a staged, regulated structure. ”

Related readings

Second, he argued that the central issue is Ripple’s incompetent inability to sell directly to the institutions, where intermediaries appear. “Routing is done through a detained SEC registration manager, rather than passing XRP over investors.

Third, Dark Horse challenged Nisbett’s claim that there is no relationship between Ripple and Webs. “Check out Ripplenet Corridors and the previous Asia-Pacific Mobility Pilot Case,” he writes. “The relationship between Ripple’s network and XRPL’s liquidity route goes back several years ago. Just because it wasn’t front page news doesn’t mean it didn’t happen.”

Finally, he challenged the notion that Webus’ XRP Holdings is merely passive. “‘Just keeping the balance sheet’ is not an automatic exemption,” he argued. “This is a development by the Ministry of Finance, not custody of idols. The fact that Webus constituted this through a delegated SEC manager states that it considers the institutional risk of XRP as a legal factor.”

He said frankly: “This is not dumping tokens in exchange. It creates an institutional conduit that complies while sailing around the bottleneck of the injunction.”

Despite the detailed structure and second-plane components, the varnish bet remained motionless. “No, I get what you’re saying… I don’t agree that the mechanism is an unexpected event,” he wrote. “It’s the natural maturation of the market, and the market responds to legal hurdles, as the market always has.”

Ripple is tied to Judge Torres’ 2024 permanent injunction. This prohibits direct institutional XRP sales unless registered – there is debate over whether Webus structures constitute an indirect rotation or legal evolution. The SEC has not yet commented, and the court recently denied the party’s request to destroy the injunction, calling it “procedurally inappropriate.”

At the time of press, the XRP traded for $2.1989.

Featured images created with dall.e, charts on tradingview.com

A new malware campaign targeting WordPress sites employs a malicious plugin disguised as a security tool to trick users into installing and trusting it.

According to Wordfence researchers, the malware provides attackers with persistent access, remote code execution, and JavaScript injection. At the same time, it remains hidden from the plugin dashboard to evade detection.

Wordfence first discovered the malware during a site cleanup in late January 2025, where it found a modified ‘wp-cron.php’ file, which creates and programmatically activates a malicious plugin named ‘WP-antymalwary-bot.php.’

Other plugin names used in the campaign include:

• addons.php
• wpconsole.php
• wp-performance-booster.php
• scr.php

If the plugin is deleted, wp-cron.php re-creates and reactivates it automatically on the next site visit.

Lacking server logs to help identify the exact infection chain, Wordfence hypothesizes the infection occurs via a compromised hosting account or FTP credentials.

Not much is known about the perpetrators, though the researchers noted that the command and control (C2) server is located in Cyprus, and there are traits similar to a June 2024 supply chain attack.

Once active on the server, the plugin performs a self-status check and then gives the attacker administrator access.

“The plugin provides immediate administrator access to threat actors via the emergency_login_all_admins function,” explains Wordfence in its writeup.

“This function utilizes the emergency_login GET parameter in order to allow attackers to obtain administrator access to the dashboard.”

“If the correct cleartext password is provided, the function fetches all administrator user records from the database, picks the first one, and logs the attacker in as that user.”

Next, the plugin registers an unauthenticated custom REST API route that allows the insertion of arbitrary PHP code into all active theme header.php files, clearing of plugin caches, and other commands processed via a POST parameter.

An updated version of the malware can also inject base64-decoded JavaScript into the site’s

section, likely for serving visitors ads, spam, or redirecting them to unsafe sites.

Apart from file-based indicators like the listed plugins, website owners should scrutinize their ‘wp-cron.php’ and ‘header.php’ files for unexpected additions or modifications.

Access logs containing ’emergency_login,’ ‘check_plugin,’ ‘urlchange,’ and ‘key’ should also serve as red flags, warranting further investigation.

WTF?! It’s ironic how, in the information age, governments slap hefty fines on companies for not adequately securing user data but, in the same breath, demand that these companies give state agencies unrestricted access to the very same data. No matter what country you are from, warrantless mass surveillance is wrong. George Orwell’s 1984 was a warning, not an instruction manual.

The British government has ordered Apple to allow blanket access to user data stored online. The “technical capability notice” demands a backdoor into its encrypted iCloud services, which state agencies can use to access backups of any global customer without a court order. The UK Home Office issued the decree under the Investigatory Powers Act of 2016, aptly referred to as the “Snoopers’ Charter.”

The UK’s Investigatory Powers Act allows agencies to compel technology companies to assist in intercepting and obtaining communications data. While it is meant to expedite criminal investigations, the notice Apple received extends beyond targeted data requests. Instead, the government wants full access to all encrypted information. The demand challenges Apple’s Advanced Data Protection feature, which ensures only validated users can access their data. Even Apple personnel cannot decrypt customer accounts.

The Irish Sun asked Apple for comment, but a spokesperson said that the company could not legally reveal details of the notice. A representative for the UK’s Home Office was equally reluctant to share.

“We do not comment on operational matters, including, for example, confirming or denying the existence of any such notices,” the spokesperson said.

Apple has consistently maintained a firm stance on user privacy, asserting that it will not create backdoors into its products. It prominently fought the US government over the same issue multiple times after receiving demands from the FBI insisting it crack the phones of suspected criminals.

Breaking: UK Government orders Apple to let them spy on users’ encrypted messages

“We are extremely troubled by reports that the UK government has ordered Apple to create a backdoor that would effectively break encryption for millions of users – an unprecedented attack on… pic.twitter.com/sYzQSQClRe

– Big Brother Watch (@BigBrotherWatch) February 7, 2025

As it has in the past, Apple has indicated a refusal to comply with the order, suggesting it might withdraw certain security features from the UK market rather than compromise its global security standards. It is too early to tell if Cupertino’s counterproposal will sway UK officials. However, it is most certainly to gain support from British iPhone owners, who will likely apply pressure against this invasion of privacy.

Critics argue that obliging Apple to create a backdoor could set a dangerous precedent, potentially leading other countries to demand similar access. This situation has global cybersecurity implications and likely conflicts with other nations’ privacy laws. Civil liberties group Big Brother Watch calls the order a severe threat to privacy rights and has called for its withdrawal.

“We are extremely troubled by reports that the UK Government has ordered Apple to create a backdoor that would effectively break encryption for millions of users,” said Rebecca Vincent, Big Brother Watch’s interim director of privacy. “[This is] an unprecedented attack on privacy rights that has no place in any democracy.”

Apple is not the first firm to face the UK’s controversial stance on encryption. In 2023, encrypted messaging companies WhatsApp and Signal threatened to exit the UK market rather than compromise encryption protocols. This newest development against Apple could further strain relationships between the UK government and technology firms.

Image credit: Electronic Frontier Foundation