The Signal Clone the Trump Admin Uses Was Hacked

[demmiblue]

A hacker has breached and stolen customer data from TeleMessage, an obscure Israeli company that sells modified versions of Signal and other messaging apps to the U.S. government to archive messages, 404 Media has learned. The data stolen by the hacker contains the contents of some direct messages and group chats sent using its Signal clone, as well as modified versions of WhatsApp, Telegram, and WeChat. TeleMessage was recently the center of a wave of media coverage after Mike Waltz accidentally revealed he used the tool in a cabinet meeting with President Trump.

The hack shows that an app gathering messages of the highest ranking officials in the government—Waltz’s chats on the app include recipients that appear to be Marco Rubio, Tulsi Gabbard, and JD Vance—contained serious vulnerabilities that allowed a hacker to trivially access the archived chats of some people who used the same tool. The hacker has not obtained the messages of cabinet members, Waltz, and people he spoke to, but the hack shows that the archived chat logs are not end-to-end encrypted between the modified version of the messaging app and the ultimate archive destination controlled by the TeleMessage customer.

Data related to Customs and Border Protection (CBP), the cryptocurrency giant Coinbase, and other financial institutions are included in the hacked material, according to screenshots of messages and backend systems obtained by 404 Media.

The breach is hugely significant not just for those individual customers, but also for the U.S. government more widely. On Thursday, 404 Media was first to report that at the time U.S. National Security Advisor Waltz accidentally revealed he was using TeleMessage’s modified version of Signal during the cabinet meeting. The use of that tool raised questions about what classification of information was being discussed across the app and how that data was being secured, and came after revelations top U.S. officials were using Signal to discuss active combat operations.

https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/

[Bernardo de La Paz]

1. People think it is an app on phone, but it is a huge pool of data on a foreign server waiting to be harvested. . . . nt

[demmiblue]

2. One hacked message was sent to a group chat apparently associated with the crypto firm Galaxy Digital. One message said,

One hacked message was sent to a group chat apparently associated with the crypto firm Galaxy Digital. One message said, "need 7 dems to get to 60.. would be very close" to the "GD Macro" group. Another message said, "Just spoke to a D staffer on the senate side - 2 cosponsors (Alsobrooks and gillibrand) did not sign the opposition letter so they think the bill still has a good chance of passage the

senate with 5 more Ds supporting it." This means a hacker was able to steal what appears to be active, timely discussion about the efforts behind passing a hugely important and controversial cryptocurrency bill; Saturday, Democratic lawmakers published a letter explaining they would oppose it. Bill cosponsors Maryland Sen. Angela Alsobrooks and New York Sen. Kirsten Gillibranddid not sign that letter.

— Micah Lee (@micahflee.com) 2025-05-04T22:43:49.545Z

[demmiblue]

3. Here is a screenshot the hacker provided of their access to TeleMessage's systems. This was a list of Customs and Border

[demmiblue]

4. This took all less than 30 minutes, btw.

Incredible. A hacker hacked into Telemessage and obtained records stored on Telemessage servers by Republican Senate staffers, CBP, Coinbase, D.C. Metro Police, Galaxy, Scotia bank and others.

It took them 20 minutes to access the servers. They then contacted 404Media anonymously and shared info.🫡

The hacker told 404 Media that they targeted TeleMessage because they were "just curious how secure it was." They did not want to disclose the issue to the company directly because they believed the company might "try their best tocover it up."

"If I could have found this in less than 30 minutes then anybody else could too.
And who knows how long it's been vulnerable?" the hacker said.

404 Media is not explaining in detail how the hacker managed to obtain this datain case others may try to exploit the same vulnerability.

According to public procurement records, TeleMessage has contracts with a range of U.S. government agencies, including the State Department and Centersfor Disease Control and Prevention.

Incredible. A hacker hacked into Telemessage and obtained records stored on Telemessage servers by Republican Senate staffers, CBP, Coinbase, D.C. Metro Police, Galaxy, Scotia bank and others.

It took them 20 minutes to access the servers. They then contacted 404Media anonymously and shared info.🫡

— WakeMeWhenItsOver🤲 (@zelbel.bsky.social) 2025-05-04T23:10:30.919Z

[blogslug]

5. kick