Loading story…
Based Apparel, the merchandise website associated with FBI Director Kash Patel, was taken offline after a compromise that allegedly attempted to trick visitors into installing malware. Reporting indicated the attack was designed to deliver infostealer malware capable of stealing user credentials, and the issue was first flagged by a user on X before a security researcher analyzed the activity. As of Friday morning, the site remained offline while the incident was being addressed.
The compromise was reported alongside a separate security issue affecting Trump Mobile, which said customer information was exposed after a researcher alerted YouTubers who had purchased the company’s phone. The exposed data reportedly included names, email addresses, mailing addresses, and phone numbers, underscoring the cyber risk facing consumer-facing platforms tied to prominent political figures and brands.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
In a separate incident noted in the reporting, Trump Mobile confirmed that customer data including names, email addresses, mailing addresses, and phone numbers had been exposed. The exposure was identified after a researcher alerted YouTubers who had purchased the company's phone.
Following reports of the cyberattack, Based Apparel was taken offline on Friday. Reports said the site remained offline as of Friday morning.
Analysis of the Based Apparel incident revealed attackers used a fake Cloudflare verification prompt on a Kash Foundation merchandise page to trick macOS users into running a malicious terminal command. The payload reportedly installed an infostealer capable of stealing cryptocurrency wallet data, session tokens, Keychain contents, and browser-stored credentials.
The merchandise website Based Apparel, associated with FBI Director Kash Patel, was reportedly hacked in an attempt to infect visitors with infostealer malware designed to steal credentials. The compromise was first surfaced by a user on X and then analyzed by a security researcher.
In March 2026, Kash Patel disclosed that his personal Gmail account had been hacked. Reporting said the intrusion was widely believed to be linked to Iranian intelligence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
9 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecurityaffairs.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcesan.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcepcmag.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trump Mobile confirmed that customer personal data was exposed on the public internet after researchers and customers found that preorder and order information could be retrieved through an unprotected API. Reports said the flaw allowed simple HTTP `POST` requests to return records in batches, exposing names, email addresses, mailing addresses, cell phone numbers, order identifiers, and in some cases customer or account numbers and enrollment IDs. Multiple outlets reported that more than 27,000 customers were affected, with leaked order identifiers suggesting roughly 30,000 phone orders tied to the `T1` smartphone launch. The issue was first publicized after YouTubers Coffeezilla and penguinz0 said a researcher alerted them that their own Trump Mobile order details were accessible online, and the researcher reportedly failed to get a response from the company before the exposure became public. Trump Mobile said it found no evidence that payment card data, banking information, Social Security numbers, call records, text messages, or message content were exposed, and attributed the incident to an unnamed third-party platform provider rather than a compromise of its own systems. The company said the flaw has been addressed and an investigation is ongoing, but reports said it was still evaluating whether affected customers would be notified.
Jun 29, 2026
An investigation tied the underground alias **ModernStealer** to a cluster of dark web and Telegram accounts advertising alleged military, government, nuclear, and aerospace data, including claims involving Pakistan military procurement, the Pakistan Nuclear Regulatory Authority, the Intelligence Bureau of Pakistan, FIA documents, and a Pakistan-Turkey drone deal. Researchers found that a reused Session contact identifier connected ModernStealer postings with other aliases, including **Zu1f1q4r**, the Telegram user **Sassoon Don**, and another seller known as **PriorOps**, indicating an operational relationship across multiple leak-sale listings. The reporting stops short of confirming any underlying breach or proving that the linked identities are a single actor rather than a coordinated group or shared contact infrastructure. Analysts said the activity reflects underground sale and extortion-style leak claims rather than a disclosed exploit, and warned that the authenticity of the advertised data remains unverified. The case highlights how persistent contact identifiers can be more reliable than usernames for attribution, while affected organizations are being urged to preserve logs, validate claims with evidence, review unusual access, reset credentials where warranted, and strengthen controls such as phishing-resistant MFA.
Aug 3, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026