Risky Business #790 -- Bye bye Signal-gate, hello TeleMessage-gate

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

• White House’s off-brand Israeli Signal fork logs cleartext messages with hard coded creds while getting hacked (twice). Just … Wow.

• Ransomware attacks on UK retailers are linked, and Marks & Spencer has it extra bad

• After six years dormant, a Magento eCommerce platform backdoor comes to life

• The North Korean IT worker scam is truly webscale

• NSO group owes Meta $168m for hacking WhatsApp

This week’s episode is sponsored by vulnerability management wranglers, Nucleus Security. Aaron Unterberger joins to talk through the complexities of tracking vulnerabilities in cloud components - left to the source, right to the deployments, and …sideways into the sidecars?

This week’s show also features an excerpt from Pat’s interview with Senator Mark Warner - Scoot back one in your podcast feed (risky.biz/markwarner) to check out the full chat, or find it on Youtube (youtu.be/ZezjjoaYrQA).

This episode is available on Youtube (youtu.be/dM4TGUpMO-0) too.

Show notes

• Mike Waltz Accidentally Reveals Obscure App the Government Is Using to Archive Signal Messages (404media.co/mike-waltz-accidentally-reveals-ob…)

• Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs (micahflee.com/despite-misleading-marketing-isr…)

• The Signal Clone the Trump Admin Uses Was Hacked (404media.co/the-signal-clone-the-trump-admin-u…)

• App used by Mike Waltz suspends services after hacking claims (nbcnews.com/tech/security/telemessage-suspends…)

• Senator Demands Investigation into Trump Admin Signal Clone After 404 Media Investigation (404media.co/senator-demands-investigation-into…)

• MG on X: "Looks like TeleMessage was probably procured and rolled out under Biden. There are public records for it. t.co/XCuZpi8PL3"; / X (x.com/_MG_/status/1918148557670105354)

• Harrods becomes latest retailer to announce attempted cyberattack | The Record from Recorded Future News (therecord.media/harrods-cyberattack-uk-retailer)

• Co-op DragonForce cyber attack includes customer data, firm admits (bbc.com/news/articles/crkx3vy54nzo)

• Co-op cyber attack: Staff told to keep cameras on in meetings (bbc.com/news/articles/cg72k851dd8o)

• Hundreds of e-commerce sites hacked in supply-chain attack - Ars Technica (arstechnica.com/security/2025/05/hundreds-of-e…)

• Microsoft’s new “passwordless by default” is great but comes at a cost - Ars Technica (arstechnica.com/security/2025/05/microsoft-pus…)

• Windows RDP lets you log in using revoked passwords. Microsoft is OK with that. - Ars Technica (arstechnica.com/security/2025/04/windows-rdp-l…)

• North Korean operatives have infiltrated hundreds of Fortune 500 companies | CyberScoop (cyberscoop.com/north-korea-workers-infiltrate-…)

• US wants to cut off key player in Southeast Asian cybercrime industry | The Record from Recorded Future News (therecord.media/us-fincen-cut-off-huione-group…)

• Myanmar militia leader sanctioned by US over cyber scam connections | The Record from Recorded Future News (therecord.media/myanmar-militia-leader-us-sanc…)

• Trump proposes major cut to CISA’s budget, citing false ‘censorship’ claims | Cybersecurity Dive (cybersecuritydive.com/news/trump-cisa-budget-c…)

• NSA to cut up to 2,000 civilian roles as part of intel community downsizing | The Record from Recorded Future News (therecord.media/nsa-to-cut-up-to-2000-roles-do…)

• NSO Group owes $168M in damages to WhatsApp over spyware infections, jury says | CyberScoop (cyberscoop.com/nso-group-owes-whatsapp-over-sp…)