China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called “Smishing Triad” mainly impersonated toll road operators and shipping companies. But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff.

If you own a mobile device, the chances are excellent that at some point in the past two years you’ve received at least one instant message that warns of a delinquent toll road fee, or a wayward package from the U.S. Postal Service (USPS). Those who click the promoted link are brought to a website that spoofs the USPS or a local toll road operator and asks for payment card information.

The site will then complain that the visitor’s bank needs to “verify” the transaction by sending a one-time code via SMS. In reality, the bank is sending that code to the mobile number on file for their customer because the fraudsters have just attempted to enroll that victim’s card details into a mobile wallet.

If the visitor supplies that one-time code, their payment card is then added to a new mobile wallet on an Apple or Google device that is physically controlled by the phishers. The phishing gangs typically load multiple stolen cards to digital wallets on a single Apple or Android device, and then sell those phones in bulk to scammers who use them for fraudulent e-commerce and tap-to-pay transactions.

The moniker “Smishing Triad” comes from Resecurity, which was among the first to report in August 2023 on the emergence of three distinct mobile phishing groups based in China that appeared to share some infrastructure and innovative phishing techniques. But it is a bit of a misnomer because the phishing lures blasted out by these groups are not SMS or text messages in the conventional sense.

Rather, they are sent via iMessage to Apple device users, and via RCS on Google Android devices. Thus, the missives bypass the mobile phone networks entirely and enjoy near 100 percent delivery rate (at least until Apple and Google suspend the spammy accounts).

In a report published on March 24, the Swiss threat intelligence firm Prodaft detailed the rapid pace of innovation coming from the Smishing Triad, which it characterizes as a loosely federated group of Chinese phishing-as-a-service operators with names like Darcula, Lighthouse, and the Xinxin Group.

Prodaft said they’re seeing a significant shift in the underground economy, particularly among Chinese-speaking threat actors who have historically operated in the shadows compared to their Russian-speaking counterparts.

“Chinese-speaking actors are introducing innovative and cost-effective systems, enabling them to target larger user bases with sophisticated services,” Prodaft wrote. “Their approach marks a new era in underground business practices, emphasizing scalability and efficiency in cybercriminal operations.”

A new report from researchers at the security firm SilentPush finds the Smishing Triad members have expanded into selling mobile phishing kits targeting customers of global financial institutions like CitiGroup, MasterCard, PayPal, Stripe, and Visa, as well as banks in Canada, Latin America, Australia and the broader Asia-Pacific region.

SilentPush found the Smishing Triad now spoofs recognizable brands in a variety of industry verticals across at least 121 countries and a vast number of industries, including the postal, logistics, telecommunications, transportation, finance, retail and public sectors.

According to SilentPush, the domains used by the Smishing Triad are rotated frequently, with approximately 25,000 phishing domains active during any 8-day period and a majority of them sitting at two Chinese hosting companies: Tencent (AS132203) and Alibaba (AS45102).

“With nearly two-thirds of all countries in the world targeted by [the] Smishing Triad, it’s safe to say they are essentially targeting every country with modern infrastructure outside of Iran, North Korea, and Russia,” SilentPush wrote. “Our team has observed some potential targeting in Russia (such as domains that mentioned their country codes), but nothing definitive enough to indicate Russia is a persistent target. Interestingly, even though these are Chinese threat actors, we have seen instances of targeting aimed at Macau and Hong Kong, both special administrative regions of China.”

SilentPush’s Zach Edwards said his team found a vulnerability that exposed data from one of the Smishing Triad’s phishing pages, which revealed the number of visits each site received each day across thousands of phishing domains that were active at the time. Based on that data, SilentPush estimates those phishing pages received well more than a million visits within a 20-day time span.

The report notes the Smishing Triad boasts it has “300+ front desk staff worldwide” involved in one of their more popular phishing kits — Lighthouse — staff that is mainly used to support various aspects of the group’s fraud and cash-out schemes.

The Smishing Triad members maintain their own Chinese-language sales channels on Telegram, which frequently offer videos and photos of their staff hard at work. Some of those images include massive walls of phones used to send phishing messages, with human operators seated directly in front of them ready to receive any time-sensitive one-time codes.

As noted in February’s story How Phished Data Turns Into Apple and Google Wallets, one of those cash-out schemes involves an Android app called Z-NFC, which can relay a valid NFC transaction from one of these compromised digital wallets to anywhere in the world. For a $500 month subscription, the customer can wave their phone at any payment terminal that accepts Apple or Google pay, and the app will relay an NFC transaction over the Internet from a stolen wallet on a phone in China.

Chinese nationals were recently busted trying to use these NFC apps to buy high-end electronics in Singapore. And in the United States, authorities in California and Tennessee arrested Chinese nationals accused of using NFC apps to fraudulently purchase gift cards from retailers.

The Prodaft researchers said they were able to find a previously undocumented backend management panel for Lucid, a smishing-as-a-service operation tied to the XinXin Group. The panel included victim figures that suggest the smishing campaigns maintain an average success rate of approximately five percent, with some domains receiving over 500 visits per week.

“In one observed instance, a single phishing website captured 30 credit card records from 550 victim interactions over a 7-day period,” Prodaft wrote.

Prodaft’s report details how the Smishing Triad has achieved such success in sending their spam messages. For example, one phishing vendor appears to send out messages using dozens of Android device emulators running in parallel on a single machine.

According to Prodaft, the threat actors first acquire phone numbers through various means including data breaches, open-source intelligence, or purchased lists from underground markets. They then exploit technical gaps in sender ID validation within both messaging platforms.

“For iMessage, this involves creating temporary Apple IDs with impersonated display names, while RCS exploitation leverages carrier implementation inconsistencies in sender verification,” Prodaft wrote. “Message delivery occurs through automated platforms using VoIP numbers or compromised credentials, often deployed in precisely timed multi-wave campaigns to maximize effectiveness.

In addition, the phishing links embedded in these messages use time-limited single-use URLs that expire or redirect based on device fingerprinting to evade security analysis, they found.

“The economics strongly favor the attackers, as neither RCS nor iMessage messages incur per-message costs like traditional SMS, enabling high-volume campaigns at minimal operational expense,” Prodaft continued. “The overlap in templates, target pools, and tactics among these platforms underscores a unified threat landscape, with Chinese-speaking actors driving innovation in the underground economy. Their ability to scale operations globally and evasion techniques pose significant challenges to cybersecurity defenses.”

Ford Merrill works in security research at SecAlliance, a CSIS Security Group company. Merrill said he’s observed at least one video of a Windows binary that wraps a Chrome executable and can be used to load in target phone numbers and blast messages via RCS, iMessage, Amazon, Instagram, Facebook, and WhatsApp.

“The evidence we’ve observed suggests the ability for a single device to send approximately 100 messages per second,” Merrill said. “We also believe that there is capability to source country specific SIM cards in volume that allow them to register different online accounts that require validation with specific country codes, and even make those SIM cards available to the physical devices long-term so that services that rely on checks of the validity of the phone number or SIM card presence on a mobile network are thwarted.”

Experts say this fast-growing wave of card fraud persists because far too many financial institutions still default to sending one-time codes via SMS for validating card enrollment in mobile wallets from Apple or Google. KrebsOnSecurity interviewed multiple security executives at non-U.S. financial institutions who spoke on condition of anonymity because they were not authorized to speak to the press. Those banks have since done away with SMS-based one-time codes and are now requiring customers to log in to the bank’s mobile app before they can link their card to a digital wallet.

“Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.” -U.S. Constitution, First Amendment.

In an address to Congress this month, President Trump claimed he had “brought free speech back to America.” But barely two months into his second term, the president has waged an unprecedented attack on the First Amendment rights of journalists, students, universities, government workers, lawyers and judges.

This story explores a slew of recent actions by the Trump administration that threaten to undermine all five pillars of the First Amendment to the U.S. Constitution, which guarantees freedoms concerning speech, religion, the media, the right to assembly, and the right to petition the government and seek redress for wrongs.

THE RIGHT TO PETITION

The right to petition allows citizens to communicate with the government, whether to complain, request action, or share viewpoints — without fear of reprisal. But that right is being assaulted by this administration on multiple levels. For starters, many GOP lawmakers are now heeding their leadership’s advice to stay away from local town hall meetings and avoid the wrath of constituents affected by the administration’s many federal budget and workforce cuts.

Another example: President Trump recently fired most of the people involved in processing Freedom of Information Act (FOIA) requests for government agencies. FOIA is an indispensable tool used by journalists and the public to request government records, and to hold leaders accountable.

The biggest story by far this week was the bombshell from The Atlantic editor Jeffrey Goldberg, who recounted how he was inadvertently added to a Signal group chat with National Security Advisor Michael Waltz and 16 other Trump administration officials discussing plans for an upcoming attack on Yemen.

One overlooked aspect of Goldberg’s incredible account is that by planning and coordinating the attack on Signal — which features messages that can auto-delete after a short time — administration officials were evidently seeking a way to avoid creating a lasting (and potentially FOIA-able) record of their deliberations.

“Intentional or not, use of Signal in this context was an act of erasure—because without Jeffrey Goldberg being accidentally added to the list, the general public would never have any record of these communications or any way to know they even occurred,” Tony Bradley wrote this week at Forbes.

Petitioning the government, particularly when it ignores your requests, often requires challenging federal agencies in court. But that becomes far more difficult if the most competent law firms start to shy away from cases that may involve crossing the president and his administration.

On March 22, the president issued a memorandum that directs heads of the Justice and Homeland Security Departments to “seek sanctions against attorneys and law firms who engage in frivolous, unreasonable and vexatious litigation against the United States,” or in matters that come before federal agencies.

The POTUS recently issued several executive orders railing against specific law firms with attorneys who worked legal cases against him. On Friday, the president announced that the law firm of Skadden, Arps, Slate, Meager & Flom had agreed to provide $100 million in pro bono work on issues that he supports.

Trump issued another order naming the firm Paul, Weiss, Rifkind, Wharton & Garrison, which ultimately agreed to pledge $40 million in pro bono legal services to the president’s causes.

Other Trump executive orders targeted law firms Jenner & Block and WilmerHale, both of which have attorneys that worked with special counsel Robert Mueller on the investigation into Russian interference in the 2016 election. But this week, two federal judges in separate rulings froze parts of those orders.

“There is no doubt this retaliatory action chills speech and legal advocacy, and that is qualified as a constitutional harm,” wrote Judge Richard Leon, who ruled against the executive order targeting WilmerHale.

President Trump recently took the extraordinary step of calling for the impeachment of federal judges who rule against the administration. Trump called U.S. District Judge James Boasberg a “Radical Left Lunatic” and urged he be removed from office for blocking deportation of Venezuelan alleged gang members under a rarely invoked wartime legal authority.

In a rare public rebuke to a sitting president, U.S. Supreme Court Justice John Roberts issued a statement on March 18 pointing out that “For more than two centuries, it has been established that impeachment is not an appropriate response to disagreement concerning a judicial decision.”

The U.S. Constitution provides that judges can be removed from office only through impeachment by the House of Representatives and conviction by the Senate. The Constitution also states that judges’ salaries cannot be reduced while they are in office.

Undeterred, House Speaker Mike Johnson this week suggested the administration could still use the power of its purse to keep courts in line, and even floated the idea of wholesale eliminating federal courts.

“We do have authority over the federal courts as you know,” Johnson said. “We can eliminate an entire district court. We have power of funding over the courts, and all these other things. But desperate times call for desperate measures, and Congress is going to act, so stay tuned for that.”

FREEDOM OF ASSEMBLY

President Trump has taken a number of actions to discourage lawful demonstrations at universities and colleges across the country, threatening to cut federal funding for any college that supports protests he deems “illegal.”

A Trump executive order in January outlined a broad federal crackdown on what he called “the explosion of antisemitism” on U.S. college campuses. This administration has asserted that foreign students who are lawfully in the United States on visas do not enjoy the same free speech or due process rights as citizens.

Reuters reports that the acting civil rights director at the Department of Education on March 10 sent letters to 60 educational institutions warning they could lose federal funding if they don’t do more to combat anti-semitism. On March 20, Trump issued an order calling for the closure of the Education Department.

Meanwhile, U.S. Immigration and Customs Enforcement (ICE) agents have been detaining and trying to deport pro-Palestinian students who are legally in the United States. The administration is targeting students and academics who spoke out against Israel’s attacks on Gaza, or who were active in campus protests against U.S. support for the attacks. Secretary of State Marco Rubio told reporters Thursday that at least 300 foreign students have seen their visas revoked under President Trump, a far higher number than was previously known.

In his first term, Trump threatened to use the national guard or the U.S. military to deal with protesters, and in campaigning for re-election he promised to revisit the idea.

“I think the bigger problem is the enemy from within,” Trump told Fox News in October 2024. “We have some very bad people. We have some sick people, radical left lunatics. And I think they’re the big — and it should be very easily handled by, if necessary, by National Guard, or if really necessary, by the military, because they can’t let that happen.”

This term, Trump acted swiftly to remove the top judicial advocates in the armed forces who would almost certainly push back on any request by the president to use U.S. soldiers in an effort to quell public protests, or to arrest and detain immigrants. In late February, the president and Defense Secretary Pete Hegseth fired the top legal officers for the military services — those responsible for ensuring the Uniform Code of Military Justice is followed by commanders.

Military.com warns that the purge “sets an alarming precedent for a crucial job in the military, as President Donald Trump has mused about using the military in unorthodox and potentially illegal ways.” Hegseth told reporters the removals were necessary because he didn’t want them to pose any “roadblocks to orders that are given by a commander in chief.”

FREEDOM OF THE PRESS

President Trump has sued a number of U.S. news outlets, including 60 Minutes, CNN, The Washington Post, The New York Times and other smaller media organizations for unflattering coverage.

In a $10 billion lawsuit against 60 Minutes and its parent Paramount, Trump claims they selectively edited an interview with former Vice President Kamala Harris prior to the 2024 election. The TV news show last month published transcripts of the interview at the heart of the dispute, but Paramount is reportedly considering a settlement to avoid potentially damaging its chances of winning the administration’s approval for a pending multibillion-dollar merger.

The president sued The Des Moines Register and its parent company, Gannett, for publishing a poll showing Trump trailing Harris in the 2024 presidential election in Iowa (a state that went for Trump). The POTUS also is suing the Pulitzer Prize board over 2018 awards given to The New York Times and The Washington Post for their coverage of purported Russian interference in the 2016 election.

Whether or not any of the president’s lawsuits against news organizations have merit or succeed is almost beside the point. The strategy behind suing the media is to make reporters and newsrooms think twice about criticizing or challenging the president and his administration. The president also knows some media outlets will find it more expedient to settle.

Trump also sued ABC News and George Stephanopoulos for stating that the president had been found liable for “rape” in a civil case [Trump was found liable of sexually abusing and defaming E. Jean Carroll]. ABC parent Disney settled that claim by agreeing to donate $15 million to the Trump Presidential Library.

Following the attack on the U.S. Capitol on Jan. 6, 2021, Facebook blocked President Trump’s account. Trump sued Meta, and after the president’s victory in 2024 Meta settled and agreed to pay Trump $25 million: $22 million would go to his presidential library, and the rest to legal fees. Meta CEO Mark Zuckerberg also announced Facebook and Instagram would get rid of fact-checkers and rely instead on reader-submitted “community notes” to debunk disinformation on the social media platform.

Brendan Carr, the president’s pick to run the Federal Communications Commission (FCC), has pledged to “dismantle the censorship cartel and restore free speech rights for everyday Americans.” But on January 22, 2025, the FCC reopened complaints against ABC, CBS and NBC over their coverage of the 2024 election. The previous FCC chair had dismissed the complaints as attacks on the First Amendment and an attempt to weaponize the agency for political purposes.

According to Reuters, the complaints call for an investigation into how ABC News moderated the pre-election TV debate between Trump and Biden, and appearances of then-Vice President Harris on 60 Minutes and on NBC’s “Saturday Night Live.”

Since then, the FCC has opened investigations into NPR and PBS, alleging that they are breaking sponsorship rules. The Center for Democracy & Technology (CDT), a think tank based in Washington, D.C., noted that the FCC is also investigating KCBS in San Francisco for reporting on the location of federal immigration authorities.

“Even if these investigations are ultimately closed without action, the mere fact of opening them – and the implicit threat to the news stations’ license to operate – can have the effect of deterring the press from news coverage that the Administration dislikes,” the CDT’s Kate Ruane observed.

Trump has repeatedly threatened to “open up” libel laws, with the goal of making it easier to sue media organizations for unfavorable coverage. But this week, the U.S. Supreme Court declined to hear a challenge brought by Trump donor and Las Vegas casino magnate Steve Wynn to overturn the landmark 1964 decision in New York Times v. Sullivan, which insulates the press from libel suits over good-faith criticism of public figures.

The president also has insisted on picking which reporters and news outlets should be allowed to cover White House events and participate in the press pool that trails the president. He barred the Associated Press from the White House and Air Force One over their refusal to call the Gulf of Mexico by another name.

And the Defense Department has ordered a number of top media outlets to vacate their spots at the Pentagon, including CNN, The Hill, The Washington Post, The New York Times, NBC News, Politico and National Public Radio.

“Incoming media outlets include the New York Post, Breitbart, the Washington Examiner, the Free Press, the Daily Caller, Newsmax, the Huffington Post and One America News Network, most of whom are seen as conservative or favoring Republican President Donald Trump,” Reuters reported.

FREEDOM OF SPEECH

Shortly after Trump took office again in January 2025, the administration began circulating lists of hundreds of words that government staff and agencies shall not use in their reports and communications.

The Brookings Institution notes that in moving to comply with this anti-speech directive, federal agencies have purged countless taxpayer-funded data sets from a swathe of government websites, including data on crime, sexual orientation, gender, education, climate, and global development.

The New York Times reports that in the past two months, hundreds of terabytes of digital resources analyzing data have been taken off government websites.

“While in many cases the underlying data still exists, the tools that make it possible for the public and researchers to use that data have been removed,” The Times wrote.

On Jan. 27, Trump issued a memo (PDF) that paused all federally funded programs pending a review of those programs for alignment with the administration’s priorities. Among those was ensuring that no funding goes toward advancing “Marxist equity, transgenderism, and green new deal social engineering policies.”

According to the CDT, this order is a blatant attempt to force government grantees to cease engaging in speech that the current administration dislikes, including speech about the benefits of diversity, climate change, and LGBTQ issues.

“The First Amendment does not permit the government to discriminate against grantees because it does not like some of the viewpoints they espouse,” the CDT’s Ruane wrote. “Indeed, those groups that are challenging the constitutionality of the order argued as much in their complaint, and have won an injunction blocking its implementation.”

On January 20, the same day Trump issued an executive order on free speech, the president also issued an executive order titled “Reevaluating and Realigning United States Foreign Aid,” which froze funding for programs run by the U.S. Agency for International Development (USAID). Among those were programs designed to empower civil society and human rights groups, journalists and others responding to digital repression and Internet shutdowns.

According to the Electronic Frontier Foundation (EFF), this includes many freedom technologies that use cryptography, fight censorship, protect freedom of speech, privacy and anonymity for millions of people around the world.

“While the State Department has issued some limited waivers, so far those waivers do not seem to cover the open source internet freedom technologies,” the EFF wrote about the USAID disruptions. “As a result, many of these projects have to stop or severely curtail their work, lay off talented workers, and stop or slow further development.”

On March 14, the president signed another executive order that effectively gutted the U.S. Agency for Global Media (USAGM), which oversees or funds media outlets including Radio Free Europe/Radio Liberty and Voice of America (VOA). The USAGM also oversees Radio Free Asia, which supporters say has been one of the most reliable tools used by the government to combat Chinese propaganda.

But this week, U.S. District Court Judge Royce Lamberth, a Reagan appointee, temporarily blocked USAGM’s closure by the administration.

“RFE/RL has, for decades, operated as one of the organizations that Congress has statutorily designated to carry out this policy,” Lamberth wrote in a 10-page opinion. “The leadership of USAGM cannot, with one sentence of reasoning offering virtually no explanation, force RFE/RL to shut down — even if the President has told them to do so.”

FREEDOM OF RELIGION

The Trump administration rescinded a decades-old policy that instructed officers not to take immigration enforcement actions in or near “sensitive” or “protected” places, such as churches, schools, and hospitals.

That directive was immediately challenged in a case brought by a group of Quakers, Baptists and Sikhs, who argued the policy reversal was keeping people from attending services for fear of being arrested on civil immigration violations. On Feb. 24, a federal judge agreed and blocked ICE agents from entering churches or targeting migrants nearby.

The president’s executive order allegedly addressing antisemitism came with a fact sheet that described college campuses as “infested” with “terrorists” and “jihadists.” Multiple faith groups expressed alarm over the order, saying it attempts to weaponize antisemitism and promote “dehumanizing anti-immigrant policies.”

The president also announced the creation of a “Task Force to Eradicate Anti-Christian Bias,” to be led by Attorney General Pam Bondi. Never mind that Christianity is easily the largest faith in America and that Christians are well-represented in Congress.

The Rev. Paul Brandeis Raushenbush, a Baptist minister and head of the progressive Interfaith Alliance, issued a statement accusing Trump of hypocrisy in claiming to champion religion by creating the task force.

“From allowing immigration raids in churches, to targeting faith-based charities, to suppressing religious diversity, the Trump Administration’s aggressive government overreach is infringing on religious freedom in a way we haven’t seen for generations,” Raushenbush said.

A statement from Americans United for Separation of Church and State said the task force could lead to religious persecution of those with other faiths.

“Rather than protecting religious beliefs, this task force will misuse religious freedom to justify bigotry, discrimination, and the subversion of our civil rights laws,” said Rachel Laser, the group’s president and CEO.

Where is President Trump going with all these blatant attacks on the First Amendment? The president has made no secret of his affection for autocratic leaders and “strongmen” around the world, and he is particularly enamored with Hungary’s far-right Prime Minister Viktor Orbán, who has visited Trump’s Mar-a-Lago resort twice in the past year.

A March 15 essay in The Atlantic by Hungarian investigative journalist András Pethő recounts how Orbán rose to power by consolidating control over the courts, and by building his own media universe while simultaneously placing a stranglehold on the independent press.

“As I watch from afar what’s happening to the free press in the United States during the first weeks of Trump’s second presidency — the verbal bullying, the legal harassment, the buckling by media owners in the face of threats — it all looks very familiar,” Pethő wrote. “The MAGA authorities have learned Orbán’s lessons well.”

Authorities in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on a custom Android app to relay tap-to-pay transactions from mobile devices located in China.

Authorities in Knoxville, Tennessee last week said they arrested 11 Chinese nationals accused of buying tens of thousands of dollars worth of gift cards at local retailers with mobile wallets created through online phishing scams. The Knox County Sheriff’s office said the arrests are considered the first in the nation for a new type of tap-to-pay fraud.

Responding to questions about what makes this scheme so remarkable, Knox County said that while it appears the fraudsters are simply buying gift cards, in fact they are using multiple transactions to purchase various gift cards and are plying their scam from state to state.

“These offenders have been traveling nationwide, using stolen credit card information to purchase gift cards and launder funds,” Knox County Chief Deputy Bernie Lyon wrote. “During Monday’s operation, we recovered gift cards valued at over $23,000, all bought with unsuspecting victims’ information.”

Asked for specifics about the mobile devices seized from the suspects, Lyon said “tap-to-pay fraud involves a group utilizing Android phones to conduct Apple Pay transactions utilizing stolen or compromised credit/debit card information,” [emphasis added].

Lyon declined to offer additional specifics about the mechanics of the scam, citing an ongoing investigation.

Ford Merrill works in security research at SecAlliance, a CSIS Security Group company. Merrill said there aren’t many valid use cases for Android phones to transmit Apple Pay transactions. That is, he said, unless they are running a custom Android app that KrebsOnSecurity wrote about last month as part of a deep dive into the operations of China-based phishing cartels that are breathing new life into the payment card fraud industry (a.k.a. “carding”).

How are these China-based phishing groups obtaining stolen payment card data and then loading it onto Google and Apple phones? It all starts with phishing.

If you own a mobile phone, the chances are excellent that at some point in the past two years it has received at least one phishing message that spoofs the U.S. Postal Service to supposedly collect some outstanding delivery fee, or an SMS that pretends to be a local toll road operator warning of a delinquent toll fee.

These messages are being sent through sophisticated phishing kits sold by several cybercriminals based in mainland China. And they are not traditional SMS phishing or “smishing” messages, as they bypass the mobile networks entirely. Rather, the missives are sent through the Apple iMessage service and through RCS, the functionally equivalent technology on Google phones.

People who enter their payment card data at one of these sites will be told their financial institution needs to verify the small transaction by sending a one-time passcode to the customer’s mobile device. In reality, that code will be sent by the victim’s financial institution in response to a request by the fraudsters to link the phished card data to a mobile wallet.

If the victim then provides that one-time code, the phishers will link the card data to a new mobile wallet from Apple or Google, loading the wallet onto a mobile phone that the scammers control. These phones are then loaded with multiple stolen wallets (often between 5-10 per device) and sold in bulk to scammers on Telegram.

Merrill found that at least one of the Chinese phishing groups sells an Android app called “Z-NFC” that can relay a valid NFC transaction to anywhere in the world. The user simply waves their phone at a local payment terminal that accepts Apple or Google pay, and the app relays an NFC transaction over the Internet from a phone in China.

“I would be shocked if this wasn’t the NFC relay app,” Merrill said, concerning the arrested suspects in Tennessee.

Merrill said the Z-NFC software can work from anywhere in the world, and that one phishing gang offers the software for $500 a month.

“It can relay both NFC enabled tap-to-pay as well as any digital wallet,” Merrill said. “They even have 24-hour support.”

On March 16, the ABC affiliate in Sacramento (ABC10), Calif. aired a segment about two Chinese nationals who were arrested after using an app to run stolen credit cards at a local Target store. The news story quoted investigators saying the men were trying to buy gift cards using a mobile app that cycled through more than 80 stolen payment cards.

ABC10 reported that while most of those transactions were declined, the suspects still made off with $1,400 worth of gift cards. After their arrests, both men reportedly admitted that they were being paid $250 a day to conduct the fraudulent transactions.

Merrill said it’s not unusual for fraud groups to advertise this kind of work on social media networks, including TikTok.

A CBS News story on the Sacramento arrests said one of the suspects tried to use 42 separate bank cards, but that 32 were declined. Even so, the man still was reportedly able to spend $855 in the transactions.

Likewise, the suspect’s alleged accomplice tried 48 transactions on separate cards, finding success 11 times and spending $633, CBS reported.

“It’s interesting that so many of the cards were declined,” Merrill said. “One reason this might be is that banks are getting better at detecting this type of fraud. The other could be that the cards were already used and so they were already flagged for fraud even before these guys had a chance to use them. So there could be some element of just sending these guys out to stores to see if it works, and if not they’re on their own.”

Merrill’s investigation into the Telegram sales channels for these China-based phishing gangs shows their phishing sites are actively manned by fraudsters who sit in front of giant racks of Apple and Google phones that are used to send the spam and respond to replies in real time.

In other words, the phishing websites are powered by real human operators as long as new messages are being sent. Merrill said the criminals appear to send only a few dozen messages at a time, likely because completing the scam takes manual work by the human operators in China. After all, most one-time codes used for mobile wallet provisioning are generally only good for a few minutes before they expire.

For more on how these China-based mobile phishing groups operate, check out How Phished Data Turns Into Apple and Google Wallets.

A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then immediately placed on leave, asking employees to send their Social Security number or date of birth in a password-protected email attachment — presumably with the password needed to view the file included in the body of the email.

On March 13, a Maryland district court judge ordered the Trump administration to reinstate more than 130 probationary CISA employees who were fired last month. On Monday, the administration announced that those dismissed employees would be reinstated but placed on paid administrative leave. They are among nearly 25,000 fired federal workers who are in the process of being rehired.

A notice covering the CISA homepage said the administration is making every effort to contact those who were unlawfully fired in mid-February.

“Please provide a password protected attachment that provides your full name, your dates of employment (including date of termination), and one other identifying factor such as date of birth or social security number,” the message reads. “Please, to the extent that it is available, attach any termination notice.”

The message didn’t specify how affected CISA employees should share the password for any attached files, so the implicit expectation is that employees should just include the plaintext password in their message.

Email is about as secure as a postcard sent through the mail, because anyone who manages to intercept the missive anywhere along its path of delivery can likely read it. In security terms, that’s the equivalent of encrypting sensitive data while also attaching the secret key needed to view the information.

What’s more, a great many antivirus and security scanners have trouble inspecting password-protected files, meaning the administration’s instructions are likely to increase the risk that malware submitted by cybercriminals could be accepted and opened by U.S. government employees.

The message in the screenshot above was removed from the CISA homepage Tuesday evening and replaced with a much shorter notice directing former CISA employees to contact a specific email address. But a slightly different version of the same message originally posted to CISA’s website still exists at the website for the U.S. Citizenship and Immigration Services, which likewise instructs those fired employees who wish to be rehired and put on leave to send a password-protected email attachment with sensitive personal data.

This is hardly the first example of the administration discarding Security 101 practices in the name of expediency. Last month, the Central Intelligence Agency (CIA) sent an unencrypted email to the White House with the first names and first letter of the last names of recently hired CIA officers who might be easy to fire.

As cybersecurity journalist Shane Harris noted in The Atlantic, even those fragments of information could be useful to foreign spies.

“Over the weekend, a former senior CIA official showed me the steps by which a foreign adversary who knew only his first name and last initial could have managed to identify him from the single line of the congressional record where his full name was published more than 20 years ago, when he became a member of the Foreign Service,” Harris wrote. “The former official was undercover at the time as a State Department employee. If a foreign government had known even part of his name from a list of confirmed CIA officers, his cover would have been blown.”

The White House has also fired at least 100 intelligence staffers from the National Security Agency (NSA), reportedly for using an internal NSA chat tool to discuss their personal lives and politics. Testifying before the House Select Committee on the Communist Party earlier this month, the NSA’s former top cybersecurity official said the Trump administration’s attempts to mass fire probationary federal employees will be “devastating” to U.S. cybersecurity operations.

Rob Joyce, who spent 34 years at the NSA, told Congress how important those employees are in sustaining an aggressive stance against China in cyberspace.

“At my former agency, remarkable technical talent was recruited into developmental programs that provided intensive unique training and hands-on experience to cultivate vital skills,” Joyce told the panel. “Eliminating probationary employees will destroy a pipeline of top talent responsible for hunting and eradicating [Chinese] threats.”

Both the message to fired CISA workers and DOGE’s ongoing efforts to bypass vetted government networks for a faster Wi-Fi signal are emblematic of this administration’s overall approach to even basic security measures: To go around them, or just pretend they don’t exist for a good reason.

On Monday, The New York Times reported that U.S. Secret Service agents at the White House were briefly on alert last month when a trusted captain of Elon Musk’s “Department of Government Efficiency” (DOGE) visited the roof of the Eisenhower building inside the White House compound — to see about setting up a dish to receive satellite Internet access directly from Musk’s Starlink service.

The White House press secretary told The Times that Starlink had “donated” the service and that the gift had been vetted by the lawyer overseeing ethics issues in the White House Counsel’s Office. The White House claims the service is necessary because its wireless network is too slow.

Jake Williams, vice president for research and development at the cybersecurity consulting firm Hunter Strategy, told The Times “it’s super rare” to install Starlink or another internet provider as a replacement for existing government infrastructure that has been vetted and secured.

“I can’t think of a time that I have heard of that,” Williams said. “It introduces another attack point,” Williams said. “But why introduce that risk?”

Meanwhile, NBC News reported on March 7 that Starlink is expanding its footprint across the federal government.

“Multiple federal agencies are exploring the idea of adopting SpaceX’s Starlink for internet access — and at least one agency, the General Services Administration (GSA), has done so at the request of Musk’s staff, according to someone who worked at the GSA last month and is familiar with its network operations — despite a vow by Musk and Trump to slash the overall federal budget,” NBC wrote.

The longtime Musk employee who encountered the Secret Service on the roof in the White House complex was Christopher Stanley, the 33-year-old senior director for security engineering at X and principal security engineer at SpaceX.

On Monday, Bloomberg broke the news that Stanley had been tapped for a seat on the board of directors at the mortgage giant Fannie Mae. Stanley was added to the board alongside newly confirmed Federal Housing Finance Agency director Bill Pulte, the grandson of the late housing businessman and founder of PulteGroup — William J. Pulte.

In a nod to his new board role atop an agency that helps drive the nation’s $12 trillion mortgage market, Stanley retweeted a Bloomberg story about the hire with a smiley emoji and the comment “Tech Support.”

But earlier today, Bloomberg reported that Stanley had abruptly resigned from the Fannie board, and that details about the reason for his quick departure weren’t immediately clear. As first reported here last month, Stanley had a brush with celebrity on Twitter in 2015 when he leaked the user database for the DDoS-for-hire service LizardStresser, and soon faced threats of physical violence against his family.

My 2015 story on that leak did not name Stanley, but he exposed himself as the source by posting a video about it on his Youtube channel. A review of domain names registered by Stanley shows he went by the nickname “enKrypt,” and was the former owner of a pirated software and hacking forum called error33[.]net, as well as theC0re, a video game cheating community.

Stanley is one of more than 50 DOGE workers, mostly young men and women who have worked with one or more of Musk’s companies. The Trump administration remains dogged by questions about how many — if any — of the DOGE workers were put through the gauntlet of a thorough security background investigation before being given access to such sensitive government databases.

That’s largely because in one of his first executive actions after being sworn in for a second term on Jan. 20, President Trump declared that the security clearance process was simply too onerous and time-consuming, and that anyone so designated by the White House counsel would have full top secret/sensitive compartmented information (TS/SCI) clearances for up to six months. Translation: We accepted the risk, so TAH-DAH! No risk!

Presumably, this is the same counsel who saw no ethical concerns with Musk “donating” Starlink to the White House, or with President Trump summoning the media to film him hawking Cybertrucks and Teslas (a.k.a. “Teslers”) on the White House lawn last week.

Mr. Musk’s unelected role as head of an ad hoc executive entity that is gleefully firing federal workers and feeding federal agencies into “the wood chipper” has seen his Tesla stock price plunge in recent weeks, while firebombings and other vandalism attacks on property carrying the Tesla logo are cropping up across the U.S. and overseas and driving down Tesla sales.

President Trump and his attorney general Pam Bondi have dubiously asserted that those responsible for attacks on Tesla dealerships are committing “domestic terrorism,” and that vandals will be prosecuted accordingly. But it’s not clear this administration would recognize a real domestic security threat if it was ensconced squarely behind the Resolute Desk.

Or at the pinnacle of the Federal Bureau of Investigation (FBI). The Washington Post reported last month that Trump’s new FBI director Kash Patel was paid $25,000 last year by a film company owned by a dual U.S. Russian citizen that has made programs promoting “deep state” conspiracy theories pushed by the Kremlin.

“The resulting six-part documentary appeared on Tucker Carlson’s online network, itself a reliable conduit for Kremlin propaganda,” The Post reported. “In the film, Patel made his now infamous pledge to shut down the FBI’s headquarters in Washington and ‘open it up as a museum to the deep state.'”

When the head of the FBI is promising to turn his own agency headquarters into a mocking public exhibit on the U.S. National Mall, it may seem silly to fuss over the White House’s clumsy and insulting instructions to former employees they unlawfully fired.

Indeed, one consistent feedback I’ve heard from a subset of readers here is something to this effect: “I used to like reading your stuff more when you weren’t writing about politics all the time.”

My response to that is: “Yeah, me too.” It’s not that I’m suddenly interested in writing about political matters; it’s that various actions by this administration keep intruding on my areas of coverage.

A less charitable interpretation of that reader comment is that anyone still giving such feedback is either dangerously uninformed, being disingenuous, or just doesn’t want to keep being reminded that they’re on the side of the villains, despite all the evidence showing it.

Article II of the U.S. Constitution unambiguously states that the president shall take care that the laws be faithfully executed. But almost from Day One of his second term, Mr. Trump has been acting in violation of his sworn duty as president by choosing not to enforce laws passed by Congress (TikTok ban, anyone?), by freezing funds already allocated by Congress, and most recently by flouting a federal court order while simultaneously calling for the impeachment of the judge who issued it. Sworn to uphold, protect and defend The Constitution, President Trump appears to be creating new constitutional challenges with almost each passing day.

When Mr. Trump was voted out of office in November 2020, he turned to baseless claims of widespread “election fraud” to explain his loss — with deadly and long-lasting consequences. This time around, the rallying cry of DOGE and White House is “government fraud,” which gives the administration a certain amount of cover for its actions among a base of voters that has long sought to shrink the size and cost of government.

In reality, “government fraud” has become a term of derision and public scorn applied to anything or anyone the current administration doesn’t like. If DOGE and the White House were truly interested in trimming government waste, fraud and abuse, they could scarcely do better than consult the inspectors general fighting it at various federal agencies.

After all, the inspectors general likely know exactly where a great deal of the federal government’s fiscal skeletons are buried. Instead, Mr. Trump fired at least 17 inspectors general, leaving the government without critical oversight of agency activities. That action is unlikely to stem government fraud; if anything, it will only encourage such activity.

As Techdirt founder Mike Masnick noted in a recent column “Why Techdirt is Now a Democracy Blog (Whether We Like it or Not),” when the very institutions that made American innovation possible are being systematically dismantled, it’s not a “political” story anymore: It’s a story about whether the environment that enabled all the other stories we cover will continue to exist.

“This is why tech journalism’s perspective is so crucial right now,” Masnick wrote. “We’ve spent decades documenting how technology and entrepreneurship can either strengthen or undermine democratic institutions. We understand the dangers of concentrated power in the digital age. And we’ve watched in real-time as tech leaders who once championed innovation and openness now actively work to consolidate control and dismantle the very systems that enabled their success.”

“But right now, the story that matters most is how the dismantling of American institutions threatens everything else we cover,” Masnick continued. “When the fundamental structures that enable innovation, protect civil liberties, and foster open dialogue are under attack, every other tech policy story becomes secondary.”

Authorities in India today arrested the alleged co-founder of Garantex, a cryptocurrency exchange sanctioned by the U.S. government in 2022 for facilitating tens of billions of dollars in money laundering by transnational criminal and cybercriminal organizations. Sources close to the investigation told KrebsOnSecurity the Lithuanian national Aleksej Besciokov, 46, was apprehended while vacationing on the coast of India with his family.

On March 7, the U.S. Department of Justice (DOJ) unsealed an indictment against Besciokov and the other alleged co-founder of Garantex, Aleksandr Mira Serda, 40, a Russian national living in the United Arab Emirates.

Launched in 2019, Garantex was first sanctioned by the U.S. Treasury Office of Foreign Assets Control in April 2022 for receiving hundreds of millions in criminal proceeds, including funds used to facilitate hacking, ransomware, terrorism and drug trafficking. Since those penalties were levied, Garantex has processed more than $60 billion, according to the blockchain analysis company Elliptic.

“Garantex has been used in sanctions evasion by Russian elites, as well as to launder proceeds of crime including ransomware, darknet market trade and thefts attributed to North Korea’s Lazarus Group,” Elliptic wrote in a blog post. “Garantex has also been implicated in enabling Russian oligarchs to move their wealth out of the country, following the invasion of Ukraine.”

The DOJ alleges Besciokov was Garantex’s primary technical administrator and responsible for obtaining and maintaining critical Garantex infrastructure, as well as reviewing and approving transactions. Mira Serda is allegedly Garantex’s co-founder and chief commercial officer.

In conjunction with the release of the indictments, German and Finnish law enforcement seized servers hosting Garantex’s operations. A “most wanted” notice published by the U.S. Secret Service states that U.S. authorities separately obtained earlier copies of Garantex’s servers, including customer and accounting databases. Federal investigators say they also froze over $26 million in funds used to facilitate Garantex’s money laundering activities.

Besciokov was arrested within the past 24 hours while vacationing with his family in Varkala, a major coastal city in the southwest Indian state of Kerala. An officer with the local police department in Varkala confirmed Besciokov’s arrest, and said the suspect will appear in a Delhi court on March 14 to face charges.

The DOJ’s indictment says Besciokov went by the hacker handle “proforg.” This nickname corresponds to the administrator of a 20-year-old Russian language forum dedicated to nudity and crudity called “udaff.”

Besciokov and Mira Serda are each charged with one count of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison. Besciokov is also charged with one count of conspiracy to violate the International Economic Emergency Powers Act—which also carries a maximum sentence of 20 years in person—and with conspiracy to operate an unlicensed money transmitting business, which carries a maximum sentence of five years in prison.

Ollin is an open-source, online learning platform that allows users to create interactive simulations and games using a visual programming language.

Cloud “container” defenses have inconsistencies that can give attackers too much access. A new company, Edera, is taking on that challenge and the problem of the male-dominated startup world.

Operatives working for Elon Musk’s DOGE appear to be editing the code of AutoRIF—software designed by the Defense Department that could assist in mass firings of federal workers, sources tell WIRED.

An alleged job scam, led by “Aiden” from “OpenAI,” recruited workers in Bangladesh for months before disappearing overnight, according to FTC complaints obtained by WIRED.

On Monday morning, TV sets at the headquarters of the Department of Housing and Urban Development played the seemingly AI-generated video on loop, along with the words “LONG LIVE THE REAL KING.”

Our latest update brings improvements to Web feeds and the Track changes feature, making them more accessible and reliable than ever. Designed for power users, these tools allow you to monitor content beyond traditional RSS with greater flexibility, and our recent enhancements make them easier to use and more powerful than before.

What’s new?

• Easier access: You can now add Web feeds and Track changes feeds effortlessly from Add feed in the tab bar. They’re listed alongside all other feed types in the sidebar, making them easier to discover and use.
• Improved content selection: Remove cookie consent forms and overlay elements when selecting links or content to follow so you can track more without unnecessary restrictions.
• A more reliable experience: Enjoy faster loading speeds for external content and better feed detection for Web feeds.

New to Web feeds and Track changes? Here’s how they work:

Web feeds

Web feeds let you follow websites that don’t support RSS. To create one:

1. Go to Add feed > Web feed, paste a website URL, and click Load website.

2. Inoreader will suggest the best feed options for you. Pick one and click Follow feed.

3. If none seem right, manually select a feed by clicking the links you want to follow – just click any to view matching feeds and follow them!

Need advanced settings? Click the menu in the upper-right corner of the modal to enable JavaScript, adjust the page layout, or remove cookie consent forms and overlay elements.

Track changes

Track changes feeds allow you to monitor visual and textual updates on web pages and get notified whenever something changes. To set one up:

1. Go to Add feed > Track changes, paste the web page URL, and click Load web page.
2. To track visual changes, select the area you want to monitor, set a threshold, and click Follow feed. You’ll receive a new article in your feed whenever a change occurs.
3. To track text changes, click any text element to select it, then hit Follow feed to start receiving updates.

Just like Web feeds, you can adjust Page settings to change the layout and remove unnecessary elements.

Managing your feeds

Once added, your Web feeds and Track changes feeds will appear in the Feeds section of the tab bar. From there, you can organize them into folders, apply rules, filters, and more – just like any other feed. Looking for inspiration? Check out some use cases here.

Web feeds and Track changes are part of our Pro plan (limits apply). Ready to try them out? Upgrade today!

The post Improved Web feeds & Track changes appeared first on Inoreader blog.

A Texas teen accused of murder was released from police custody after his bond was drastically reduced from $800,000 to $100 per charge. 

Stephon Martin Morson, 19, was released from the Travis County Jail in Austin, Texas, on Saturday after he posted bail. 

Morson is accused in the shooting death of 20-year-old Keshawn Cage, who police found with a gunshot wound to the head back in October.

The Travis County Jail told Fox News Digital that Morson was booked on Nov. 6, 2024, and charged with murder and tamper/fabricate physical evidence.

TEXAS DA TO REQUEST REVERSAL OF PARDON FOR FORMER ARMY SOLDIER WHO FATALLY SHOT BLM PROTESTER

His bond was originally set at $800,000, but it was recently dropped to $100 for each charge, for a total of $200, with the conditions that Morson wear a GPS monitor, remain under house arrest and not contact the family of the victim or potential witnesses, CBS Austin first reported. 

Austin Police Association President Michael Bullock told Fox News Digital that Morson's punishment was "not enough."

"For a man accused of murder to have his bond reduced so low that he’s able to walk free is a slap in the face to Austinites who could potentially become the next victim. The revolving door of violent criminals constantly released back onto the streets of Austin is exactly why we have seen violent crime increase," Bullock said.

He added: "The District Attorney, County Attorney, and Judges here have clearly demonstrated they are not interested in looking after the safety of Austinites nor working with law enforcement. All they are interested in is their own political agenda. We’ve seen criminals released on bond who, while free, kill someone. The real question is when will enough be enough?"

Bullock said this is not the first time Travis County judges and magistrates have drastically reduced bond for a person accused of murder or sexual assault.

TEXAS JUDGE SEEKS TO KEEP SUSPECTED SERIAL KILLER BEHIND BARS FOR LIFE: 'HE NEVER, EVER HAD REMORSE'

"This is not exclusive to just one judge. This has happened across multiple different courts," Bullock said. "We’ve had some where they may not reoffend, but then we’ve had others who do reoffend. People that get out on bond and they murder someone else when they’re already accused of a violent crime."

Texas Gov. Greg Abbott also commented on Morson's release and called the move "outrageous."

"This is outrageous. It's why I made bail reform an Emergency Item," Abbott wrote in a post on X. 

TEXAS LEADERS DRAFT 'JOCELYN'S LAW' AFTER 12-YEAR-OLD'S MURDER, WOULD DENY BAIL FOR CAPITAL MURDER SUSPECTS

Texas Lt. Gov. Dan Patrick also backed Abbott and said he is ready to play "hardball" to keep violent offenders from being released on bail during a special session last week to pass a bail reform package.

On Wednesday, the bills cleared the first of many obstacles to becoming law. The Senate Criminal Justice Committee passed the bail reform package by a vote of 6-0.

"I’m grateful that Gov. Abbott declared bail reform an emergency item for the current legislative session. Too many innocent people, both citizens and law enforcement officers, have become targets of criminals due to irresponsible bail amounts that allow violent criminals to go free," Bullock said. "We are a nation of law and order, but activist judges and prosecutors that are interested in their own agenda rather than the law are eroding that principle." 

Crime victims' advocates in Texas have been trying to get tougher bail legislation on the books for years, especially in certain cases involving egregious crimes. In years past, many criminal offenders in Harris County were released on low bond or no bond at all, with some going on to reoffend, sometimes violently, according to Rania Mankarious, the CEO of Crime Stoppers of Houston.

Fox News Digital reached out to the Travis County District Attorney’s Office but did not immediately receive a response. 

Fox News Digital's Louis Casiano contributed to this report. 

William Byron won the Dayton 500, which was a marathon on Sunday night, after rain delays and yellow caution flags ultimately led to some overtime laps. 

And those two overtime laps were an absolute thrill that saw multiple spin-outs and crashes that allowed Byron to win the Daytona 500 for the second consecutive year.

Six of the last eight Daytona 500 races have ended in overtime. 

This is a developing story. More to come.

The Trump administration has filed an appeal with the Supreme Court, hoping to get permission to fire the head of the federal agency dedicated to protecting whistleblowers.

The emergency appeal, obtained by The Associated Press on Sunday, could likely be the start of a steady stream of court filings by lawyers of President Donald Trump and his administration aimed at reversing lower court rulings that have delayed his priorities for his second term in office.

The appeal seeks to prevent Hampton Dellinger from resuming his role as the head of the Office of Special Counsel.

A lower court judge previously temporarily reinstated Dellinger to his position, which he was appointed to by former President Joe Biden. Now, the Department of Justice is calling on the high court to lift the judge’s order.

AS DEMOCRATS REGROUP OUTSIDE DC, GOP ATTORNEYS GENERAL ADOPT NEW PLAYBOOK TO DEFEND TRUMP AGENDA

Dellinger has argued that by law, he can only be dismissed from his position for job performance problems, which were not cited in an email dismissing him from his post.

The Trump administration’s petition came hours after an appeals court refused to lift the order on procedural grounds, which was filed last Wednesday and is expected to expire on Feb. 26.

The case is not expected to be placed on the docket until the Supreme Court returns after the Presidents' Day holiday weekend. Once filed, the earliest the justices will be able to act will be Tuesday.

 FEDERAL JUDGE ORDERS TRUMP ADMIN TO RESTORE PUBLIC HEALTH WEB PAGES

Dellinger sued the Trump administration in D.C. federal court last Monday following his firing on Feb. 7. 

The Trump administration has been met with a wave of lawsuits since Inauguration Day, and legal experts say many of them will likely end up in the Supreme Court's hands. 

"President Trump is certainly being aggressive in terms of flexing executive power and not at all surprised that these are being challenged," John Malcolm, vice president of the Institute for Constitutional Government at the Heritage Foundation, told Fox News Digital last week.

HOUSE DEMS ORGANIZE RAPID RESPONSE TASK FORCE AND LITIGATION GROUP TO COMBAT TRUMP AGENDA

Trump kicked off his second term with a flurry of executive orders and directives that have since been targeted by a flood of legal challenges.

Since Trump's first day back in the Oval Office, more than 40 lawsuits have been filed over the administration's actions, including the president's birthright citizenship order, immigration policies, federal funding freezes, federal employee buyouts, Elon Musk's Department of Government Efficiency (DOGE), and legal action against FBI and DOJ employees.

In one of the most recent developments, a Rhode Island federal judge ordered the Trump administration to unfreeze federal funds, claiming the administration did not adhere to a previous order to do so. The Trump administration appealed the order to the First Circuit shortly thereafter, which was ultimately denied. 

Many of these lawsuits have been filed in historically left-leaning federal court jurisdictions, including D.C. federal court. Various challenges have already been appealed to the appellate courts, including the Ninth and First Circuits, which notably hand down more progressive rulings. The Ninth Circuit, in particular, has a higher reversal rate than other circuit courts.

Fox News Digital’s Haley Chi-Sing and The Associated Press contributed to this report.

Former Miami Dolphins offensive lineman Jonathan Martin is walking back his bullying accusations against his former teammate, Richie Incognito, which caused quite the scandal in 2013. 

"I never believed for a second I was being bullied," Martin told ESPN. "It’s a story that I’ve been trying to fix for 10 years."

Incognito was suspended by the Dolphins in 2013 after reports that he bullied Martin to the point where the latter stormed out of the team’s cafeteria as a result of what was said. 

CLICK HERE FOR MORE SPORTS COVERAGE ON FOXNEWS.COM

Martin, a second-round pick by the Dolphins in 2012, was in his second NFL season when the bullying controversy surrounded him and Incognito. 

The Dolphins later announced that Incognito was suspended for "conduct detrimental to the team."

The league eventually got involved, retaining lawyer Ted Wells to investigate the incident, which found that Incognito, Mike Pouncey and John Jerry had all been engaging in bullying toward Martin. 

RICHIE INCOGNITO DENIES ROLE IN BULLYING SCANDAL, BLAMES ‘DEMONS’ FOR EX-TEAMMATE BEING OUT OF NFL

The NFL’s report on the matter also said that Martin checked himself into a hospital and his mother needed to be flown across the country to be with him during that time. 

But now, Martin is blaming his parents for the situation becoming as widely known as it is today. 

"I had a situation with my teammates that I wasn’t super happy about," Martin told ESPN. "But my mother had her own read on the situation. 

"I hadn’t even told my coaches, hadn’t told anyone. And suddenly it’s on ESPN, right?" he continued. "I didn’t believe any of the stances I was taking, right, where I’m this victim. I wasn’t a victim, right? And again, it’s been a point of consternation.

"My mother maybe in her mind – I can’t read her mind – she thought she was doing the right thing."

Incognito, who missed the second half of the 2013 season and the entire 2014 campaign due to the scandal, responded after seeing Martin’s new words on the matter. 

"He couldn’t cut it in the NFL so he quit and his mom blamed me," he said, bluntly on X. "Legacy media pushed this narrative long and far. Too bad it was all a lie! They lied to protect his money. He quit…the team had every right to claw back that money. His mom started the bullying narrative with @espn @AdamSchefter so that @MiamiDolphins wouldn’t go after his signing bonus!"

While Martin’s mother, Jane, did not speak with ESPN for the interview, his father, Gus, did say his piece. 

"His mom and I did strongly intervene," he said. "To make sure he was protected."

Gus Martin also played an alleged voice from Incognito, which was left for his son at the time. The man on the phone who is allegedly Incognito threatens Jonathan Martin, using graphic language including racial slurs. 

"Hey, what’s up, you half-n----- piece of s---," Incognito allegedly says. "I saw you on Twitter, you been training 10 weeks. I’ll s--- in your f---ing mouth. I’m going to slap your f---ing mouth, I’m going to slap your real mother across the face. F--- you, you’re still a rookie. I’ll kill you."

Martin would eventually get traded to the San Francisco 49ers during the offseason after the bullying allegations were brought to light. However, he only played 15 games there before retiring after going to Carolina Panthers training camp the year after. 

Meanwhile, Incognito signed with the Buffalo Bills after his suspension was lifted by the league. He spent three seasons in upstate New York before joining the then-Oakland Raiders. 

During an appearance on "HBO’s Real Sports with Bryant Gumbel" in 2019, Incognito denied ever bullying his former teammate, blaming Martin’s "mental health issues and his demons" for being out of the league.

Incognito added, "I fit the bill. Hey, racist, homophobic, whatnot. What I’m saying was, we were close, personal friends. It wasn’t factored into, ‘Hey, this is guy talk, these are two alpha males talking to each other.’ Was some bad s--t said? Absolutely. But was this a case of bullying? Absolutely not."

Follow Fox News Digital’s sports coverage on X, and subscribe to the Fox News Sports Huddle newsletter.

A curious, energetic, smart, outgoing and thoughtful little boy.

That’s how family, friends and teachers say they will remember 5-year-old Thomas Cooper who tragically died inside a hyperbaric chamber at a medical facility in Troy, Michigan, last month.

The descriptions form part of a heartfelt obituary written about Cooper ahead of a memorial visitation held on Thursday, about two weeks after he died. 

Cooper was receiving treatment inside a chamber, a pressurized container containing 100% oxygen, when it suddenly exploded at The Oxford Center at 165 Kirts Blvd.

CELEBRITIES LIKE BIEBER, BIALIK ARE USING HYPERBARIC OXYGEN THERAPY: HERE’S WHY IT’S TRENDING

Police and fire officials said he was dead inside the chamber when they arrived on the scene, while his mother Annie, who was also inside the room, suffered injuries to her arm.

Cooper, who was in preschool, was always on the move and loved looking out for his younger brother, who was his best friend, according to the obituary.

"His favorite thing to do was play Minecraft on his Nintendo Switch, as he loved to show his Mommy and Daddy the things he could create," the tribute reads.

"His favorite activities were running, jumping, rolling and stomping … He wanted to grow up to be a chef because that meant he could ‘cook with Mommy and Daddy and stay with them forever.’"

The boy was receiving treatment for sleep apnea and attention-deficit/hyperactivity disorder at the Oxford Center, James Harrington, an attorney for the family told NBC Washington. 

DOCTOR LOSES LICENSE OVER OXYGEN CHAMBER FIRE THAT KILLED 2

The chambers are used to provide Hyperbaric oxygen therapy (HBOT) and a typical chamber can hold one person. It requires the patient to lie down in the tube-shaped device that looks like an MRI machine and breathe the oxygen. A hyperbaric chamber contains up to three times the amount of oxygen than a normal room.

Harrington said the boy’s parents were hopeful the services would improve his quality of life. 

"This wasn’t some type of lifesaving measure that was absolutely needed," Harrington told the outlet. "It was just a mother who was trying to help her son with some conditions that he had and was promised that with these conditions and this treatment, that they would be able to help."

"Annie was trying to help her child as any parent would — as good parents do."

Harrington, who is a managing partner of Fieger Law in Southfield, Michigan, said the boy had received multiple sessions of hyperbaric oxygen therapy at the center before tragedy struck.

It’s unclear what caused the chamber to explode. The family intends on filing a lawsuit to prevent a similar incident from taking place again, Harrington said, adding that the boy’s parents are "absolutely devastated."

The obituary also mentions that Cooper loved to make art and was constantly curious about the world around him and liked to know how things worked.

"At night, he liked to listen to audiobooks as he tried to go to sleep, with some of his favorites being Yoto Daily, Charlie and the Chocolate Factory, and James and the Giant Peach," the obituary reads.

As well as being used to tackle sleep apnea and attention-deficit/hyperactivity disorder, the devices are also used to treat a variety of other health problems, including carbon monoxide poisoning, diabetic foot ulcers, anemia, infection of the skin and bone and vision loss.

Such devices require FDA clearance to ensure that they are approved to be used as intended and are safe and effective.

HBOY is also well known for treating scuba and deep-sea divers affected by the rapid change in pressure around them, according to the FDA. 

In a statement to the Detroit Free Press immediately after the incident, The Oxford Center spokesperson Andrew Kistner wrote that the cause of the explosion is unknown.

"As law enforcement officials have shared, at our location in Troy, Michigan this morning, a fire started inside of a hyperbaric oxygen chamber. The child being treated in that chamber did not survive and the child’s mother was injured," the statement reads.

"The safety and wellbeing of the children we serve is our highest priority. Nothing like this has happened in our more than 15 years of providing this type of therapy. We… will participate in all of the investigations that now need to take place."

The location is temporarily closed while authorities investigate the deadly incident, NBC Washington reported. No charges have been filed, per the outlet citing police. 

In May 2009, an explosion of a pressurized oxygen chamber killed a 4-year-old and his 62-year-old grandmother. Authorities said a blast dislodged a tube attached to the hyperbaric chamber, which resulted in an explosion and flash fire, according to CBS.

A San Diego migrant shelter is closing its doors and laying off more than 100 employees because of funding and policy changes under the Trump administration.

The Jewish Family Service of San Diego, which has operated a regional migrant shelter for over six years, announced it will close its facility and lay off 115 employees due to "changes in federal funding and policy."

"Jewish Family Service of San Diego (JFS) is working to meet the evolving needs of the community in response to recent and anticipated federal policy changes," the organization previously said.

The non-governmental organization (NGO) said they have not received new asylum-seeking families or individuals since the CBP One phone app went down on Jan. 20. 

TRUMP DHS PICK NOEM PLEDGES TO END CONTROVERSIAL APP USED BY MIGRANTS ON 'DAY ONE’

The app, which ultimately allowed immigrants to be paroled into the U.S., was created during the first Trump administration to assist with scheduling cargo inspections. 

It expanded in 2023 to allow migrants to make an appointment at a port of entry to be allowed in, initially due to an exception from the Title 42 public health order. Since May, they had the potential to be paroled into the U.S. as part of the Biden administration’s expansion of "lawful pathways." 

As of the end of December, more than 936,500 individuals had made appointments to be paroled through the app, according to Customs and Border Protection.

NEW YORK CITY TO SUE TRUMP ADMIN OVER REVOKED $80M IN FEMA MIGRANT SHELTER FUNDING FOR NEW YORK CITY

"With migrants no longer able to use the CBP One application, the San Diego Rapid Response Network (SDRRN) Migrant Shelter Services, operated by JFS, has not received new asylum-seeking families and individuals released from short term federal custody into our care. Due to these changes in federal funding and policy, the SDRRN Migrant Shelter Services will be paused until there is better understanding of future community needs," the statement continued.

BORDER PATROL MOBILE APP FOR MIGRANTS SEEKING ENTRY FACES SCRUTINY FOR ITS LACK OF VETTING, SECURITY

The organization added that they were "focusing its immigration efforts on providing pro bono legal services and community support resources."

"We’ve been preparing for these changes in federal policies and enforcement," said CEO Michael Hopkins. "While there are no longer individuals or families seeking asylum released from short-term federal immigration custody to our Shelter Services, we are seeing increased needs for immigration legal assistance and other social service supports to vulnerable San Diegans. We’re also continuing to collaborate with our community partners to explore new ways to offer assistance."

The organization received $22,077,365 in taxpayer-funded FEMA money in Fiscal Year 2024 despite claiming they received no funds, according to grant records on the FEMA website.

Fox News Digital reached out to the Jewish Family Service of San Diego and FEMA but did not immediately receive a statement. 

Fox News Digital's Adam Shaw contributed to this report.

Muhsin Hendricks, known as the world's first openly gay imam, was shot and killed in South Africa over the weekend, as authorities investigate whether the murder was a hate crime.

In a statement obtained by the BBC, police said that Hendricks was killed Saturday morning while traveling near the city of Gqeberha in South Africa's Eastern Cape Province. His car was reportedly ambushed.

"Two unknown suspects with covered faces got out of the vehicle and started firing multiple shots at the vehicle," authorities said.

Hendricks founded the Inner Circle, a safe haven for gay Muslims, shortly after coming out as an openly gay imam in 1996. He was previously married to a woman before divorcing her the same year that he came out.

TRUMP FREEZES AID TO SOUTH AFRICA, PROMOTES RESETTLEMENT OF REFUGEES FACING RACE DISCRIMINATION

"The Inner Circle is the longest standing, largest and most influential human rights organization in the world that deals with Islam, gender and sexual diversity from an Islamic theological perspective," the organization's website reads. "The Inner Circle works internationally and supports international affiliate organizations to do similar work, within an Islamic framework."

In a statement, the Cape Town Ulama Board – an organization of Sunni leaders – condemned the murder but said its views do "not align with the views of the deceased."

"We maintain that Islamic teachings firmly condemn violence, murder or such actions that undermine the rule of law and destabilize society," the statement read. "Thus, the Cape Town Ulama Board urges our communities to allow the law to investigate the incident, and by following due process, we hope to maintain peace and order."

The International Lesbian, Gay, Bisexual, Trans and Intersex Association (ILGA) said in a statement that they believe the killing "may be a hate crime."

SOUTH AFRICAN PRESIDENT SIGNS CONTROVERSIAL LAND SEIZURE BILL, ERODING PRIVATE PROPERTY RIGHTS 

"He supported and mentored so many people in South Africa and around the world in their journey to reconcile with their faith, and his life has been a testament to the healing that solidarity across communities can bring in everyone’s lives," ILGA Executive Director Julia Ehrt said. "Our condolences go out to all who have been touched by his presence in all these years."

In 2022, Hendricks raised concerns about a fatwa condemning homosexuality issued by the Muslim Judicial Council. The ruling found that homosexuality is incompatible with Islam, and said that gay Muslims "have taken themselves out of the fold of Islam."

"While it did not come as a complete shock, it has left me sore considering that it was released when we just had Pride Month," Hendricks said at the time. "The phrase homosexual was only coined in the 18th century and the Qu’ran has been around way longer before that, so how can there be scriptures condemning same-sex relationships?"

Authorities are actively investigating the incident. No additional details are known at this time.

Blake Lively and husband Ryan Reynolds stepped out publicly for the first time in more than two months as they waded deeper into a legal back-and-forth with her "It Ends With Us" co-star and director, Justin Baldoni.

Lively, 37, and Reynolds were on hand at The Crane Club in New York City to celebrate Chris Rock's 60th birthday, and they posed for a photo with legendary comedian Chevy Chase in images shared on Instagram Sunday.

The following night, Lively and Reynolds, 48, made their first red carpet appearance in months for the "Saturday Night Live" 50th anniversary show at Studio 8H at Rockefeller Center.

The Hollywood power couple has remained relatively low profile since Lively filed a sexual harassment lawsuit against Baldoni, 41, in December. Her legal team last week initiated discovery to subpoena his phone records, only for Baldoni's lawyers to accuse the "Gossip Girl" actress of acting as the "FBI" in requesting the "broad, invasive, and atypical" subpoena in a motion filed Friday.  

BLAKE LIVELY VS JUSTIN BALDONI: EVERYTHING TO KNOW

"Jay and I went The Crane Club downtown to join the celebrations for @chrisrock 's 60th Birthday, hosted by @guyoseary," Chase captioned the snap with Lively and Reynolds. "So much talent! Such funny and nice guys! Made me miss my dear friend, Richard Pryor. He should’ve been there."

BLAKE LIVELY DEMANDS JUSTIN BALDONI'S PHONE RECORDS TO EXPOSE METHODS ALLEGEDLY USED TO ‘DESTROY’ HER

Chase shared photos with Eddie Murphy, Adam Sandler, Steven Spielberg, Bill Murray, David Spade and a number of the "Saturday Night Live" cast members in town for the show's 50th anniversary special.

APP USERS CLICK HERE TO VIEW POST

Social media fans took umbrage with Chase's photo selection, with users chastising the "Caddyshack" star's carousel choices. 

"Did you hire an intimacy coordinator for that picture with Blake? Hope you recorded everything in case you get sued," one user wrote. 

BLAKE LIVELY AND JUSTIN BALDONI REFUSE MEDIATION, SHOW NO SIGN OF SETTLING LAWSUIT

"Blake Lively?! Ryan Reynolds? Fire your social media person," another fan wrote. "This shows you support the Hollywood Bullies. The ones trying to crush the small guy." 

Another fan simply wrote, "So many legends! I wouldn’t know where to look!"

LIKE WHAT YOU’RE READING? CLICK HERE FOR MORE ENTERTAINMENT NEWS

While Lively and Reynolds haven't been spotted together since Dec. 3, their court battle with Baldoni continues on. Their legal team last week subpoenaed Baldoni's phone records and others involved in the courtroom showdown over an alleged plot to ruin the actress' reputation. Lively accused Baldoni of setting out on a smear campaign after allegedly sexually harassing the "Gossip Girl" star on the set of "It Ends With Us."

On Friday, his legal team filed its own motion for a discovery dispute concerning a "flagrantly overbroad" subpoena served by Lively and Reynolds, in documents obtained by Fox News Digital. Baldoni's lawyers claimed the "Lively Parties" are seeking information over a period of multiple years dating back to Dec. 2022. 

"It is hard to overstate how broad, invasive, and atypical these Subpoenas truly are," the motion stated. "This is civil litigation, not a criminal prosecution, and the Lively Parties are not the FBI. Yet the Subpoenas seek not only the complete call and text history of each of the targets over a period of several years (no matter the sender, recipient, or subject matter) but also, over the same period, real-time location information and data logs reflecting, among other things, web browsing history."

CLICK HERE TO SIGN UP FOR THE ENTERTAINMENT NEWSLETTER

Baldoni's lawyers claim the information sought by the subpoena is "wildly disproportionate to the needs of the case and unnecessarily invades the privacy of untold numbers of third parties, including family, friends, business partners, and—quite literally—any other person with whom any of the targets have communicated with over a period of years."

Lively detailed allegations of sexual harassment, retaliation, intentional affliction of emotional distress, negligence and more made by Baldoni and film producer Jamey Heath in a complaint first filed with the California Civil Rights department on Dec. 20 and later in federal court on Dec. 31.

The same day Lively filed her federal suit, Baldoni filed a $250 million suit against the New York Times for a December article about the alleged smear campaign Baldoni attempted to run against his co-star.

Weeks later, Baldoni then named Lively and Reynolds in a separate $400 million defamation lawsuit in which he accused the Hollywood power couple of attempting to hijack "It Ends With Us" and create their own narrative.

The Philadelphia Eagles were clearly a confident team heading into Super Bowl LIX, despite the Kansas City Chiefs going against them looking for their third straight Lombardi Trophy. 

Saquon Barkley’s pre-game speech, which was filmed leading up to the "Big Game," proved that confidence was high for one of the team’s most important players. 

Barkley, along with other senior members of the Eagles, gave a team speech in which he delivered a fiery assessment of the matchup ahead. 

CLICK HERE FOR MORE SPORTS COVERAGE ON FOXNEWS.COM

"As I watch film throughout the whole week, my confidence grows even more, and I hope you guys are feeling the same thing. These guys can’t f--- with us. They really can’t."

The Eagles were riding high from a blowout victory over the Washington Commanders in the NFC Championship to earn their spot in the Super Bowl.

But all week talk about potential NFL history for the Chiefs was discussed, and no matter how good a team may be, it could be a daunting task to face a team that has won back-to-back NFL titles. 

SAQUON BARKLEY LEFT SPEECHLESS AFTER FIRST SUPER BOWL TITLE: ‘YOU CAN’T USE WORDS'

However, Barkley was frank with how he felt about the Chiefs’ comfortability in this game.

"I don’t care how many times they’ve been here," Barkley continued. "I don’t care how many times they’ve won it. They haven’t seen a team like this." 

Barkley’s words were proven true as the Chiefs looked like the team not ready for the moment while the Eagles blew them out, 40-22, at Caesars Superdome in New Orleans to win the franchise’s second Lombardi Trophy.

Quarterback Jalen Hurts, who was named Super Bowl LIX MVP, also gave a speech that was recorded as well. He said that going to the Super Bowl two seasons ago was a life-changing moment. 

"I put on a good show, but I left that motherf---er empty," Hurts said, referencing the close loss the Eagles had against Kansas City in the end. 

"Ask yourself how you want to be remembered," Hurts said to his teammates. 

In the end, this Eagles team will be remembered not only as the squad that halted NFL history, but also as one of the best teams ever assembled to win it all. 

And while the play on the field is the main grab, the mindset was clearly set by the team’s stars to get them prepared for what was to come on game day.

Follow Fox News Digital’s sports coverage on X, and subscribe to the Fox News Sports Huddle newsletter.