The messaging app used by some members of the Trump administration and the US government has been hacked, according to a new report.

404 Media reports that a hacker stole customer data from TeleMessage, an Israeli software company that provides modified versions of messaging apps like Signal.

The US government reportedly uses modified apps to archive messages.

A Reuters photo last week revealed that Michael Waltz, the recently ousted national security adviser, was using TeleMessage to communicate with colleagues during a Trump administration cabinet meeting.

Trump said last week on Truth Social that he plans to nominate Waltz to serve as the US ambassador to the United Nations. The former national security adviser fell into hot water earlier this year for accidentally adding a journalist to a sensitive Signal chat about war plans between top Trump administration figures.

The identity of the hacker remains unknown, but 404 Media viewed the hacked material that was anonymously provided. The hacker also anonymously noted that the hack took 15-20 minutes and “wasn’t much effort at all.”

The hacker didn’t access Waltz’s messages specifically, but the thief did access data related to Customs and Border Protection (CBP) and the crypto exchange Coinbase, as well as other financial institutions. A screenshot shows that the hacker was able to access a TeleMessage panel that lists the names, phone numbers and email addresses of CPB employees.

The screenshot also shows an option to select 747 entries, suggesting that the attacker has access to the data of hundreds of US government employees.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Facepalm: Supply chain attacks can remain dormant for extended periods before striking their target, but they typically don’t take years to achieve their objectives. However, a recently uncovered attack managed to stay undetected for a record-breaking length of time.

At least three vendors of e-commerce software tools were compromised in a coordinated supply chain attack dating back at least six years. According to security firm Sansec, the unknown attackers injected a dangerous backdoor into the vendors’ products, only taking control of third-party e-commerce servers a few days ago.

The backdoor ultimately infected hundreds of e-commerce websites, with Sansec estimating between 500 and 1,000 total victims. The affected sites include both small businesses and large enterprises – including one $40 billion multinational corporation that Sansec declined to identify.

The compromised vendors offer extensions for Magento, the open-source e-commerce platform acquired by Adobe several years ago. Sansec reported that servers belonging to Tigren, Magesolution, and Meetanshi were breached, with the attackers injecting backdoors into their download systems.

Analysts also discovered a tampered version of the Weltpixel GoogleTagManager add-on. However, it’s still unclear whether Weltpixel’s systems were directly compromised or if only end-user e-commerce stores were affected.

Sansec described supply-chain attacks as one of the most severe threats facing online systems. After compromising the vendors’ servers, the cybercriminals gained access not only to the vendors’ customers, but also – by extension – to all end users visiting the affected e-commerce stores. Once activated, the backdoor executed its malicious payload in users’ browsers, stealing payment information in a manner reminiscent of a typical Magecart attack.

The security firm has published instructions to help website operators determine whether their e-commerce platforms have been compromised by this new supply-chain campaign. One key indicator is a PHP function that attempts to load a file named “$licenseFile”, which initiates a chain of execution ultimately leading to the injection of malicious PHP code.

Sansec said it attempted to alert the affected add-on vendors. Despite the warning, both Tigren and Magesolution reportedly continued distributing the compromised versions of their tools. Meetanshi, on the other hand, acknowledged the breach, but none of the companies provided further comment or answered follow-up questions. As Sansec noted, that’s hardly reassuring behavior from vendors claiming to offer solutions to “help online stores succeed” in the competitive world of e-commerce.

Six malicious packages have been identified on npm (Node package manager) linked to the notorious North Korean hacking group Lazarus.

The packages, which have been downloaded 330 times, are designed to steal account credentials, deploy backdoors on compromised systems, and extract sensitive cryptocurrency information.

The Socket Research Team discovered the campaign, which linked it to previously known Lazarus supply chain operations.

The threat group is known for pushing malicious packages into software registries like npm, which is used by millions of JavaScript developers, and compromising systems passively.

Similar campaigns attributed to the same threat actors have been spotted on GitHub and the Python Package Index (PyPI).

This tactic often allows them to gain initial access to valuable networks and conduct massive record-breaking attacks, like the recent $1.5 billion crypto heist from the Bybit exchange.

The six Lazarus packages discovered in npm all employ typosquatting tactics to trick developers into accidental installations:

1. is-buffer-validator – Malicious package mimicking the popular is-buffer library to steal credentials.
2. yoojae-validator – Fake validation library used to extract sensitive data from infected systems.
3. event-handle-package – Disguised as an event-handling tool but deploys a backdoor for remote access.
4. array-empty-validator – Fraudulent package designed to collect system and browser credentials.
5. react-event-dependency – Poses as a React utility but executes malware to compromise developer environments.
6. auth-validator – Mimics authentication validation tools to steal login credentials and API keys.

The packages contain malicious code designed to steal sensitive information, such as cryptocurrency wallets and browser data that contains stored passwords, cookies, and browsing history.

They also load the BeaverTail malware and the InvisibleFerret backdoor, which North Koreans previously deployed in fake job offers that led to the installation of malware.

“The code is designed to collect system environment details, including the hostname, operating system, and system directories,” explains the Socket report.

“It systematically iterates through browser profiles to locate and extract sensitive files such as Login Data from Chrome, Brave, and Firefox, as well as keychain archives on macOS.”

“Notably, the malware also targets cryptocurrency wallets, specifically extracting id.json from Solana and exodus.wallet from Exodus.”

All six Lazarus packages are still available on npm and the GitHub repositories, so the threat is still active.

Software developers are advised to double-check the packages they use for their projects and constantly scrutinize code in open-source software to find suspicious signs like obfuscated code and calls to external servers.