Full Breakdown
Based Apparel Hack Shuts Down Merchandise Site Linked to FBI Director Kash Patel
5/23/2026, 9:02:01 PM
Hack Takes Down Based Apparel Store
On Friday the Based Apparel website, selling “K$H”-branded clothing and accessories tied to FBI Director Kash Patel, went offline after a hack redirected visitors to a malicious download. Compromised page showed a Cloudflare verification prompt that, when copied, executed a hidden command installing an infostealer on computers. The homepage later displayed a notice promising “making improvements” and a return “bolder than ever.”
Context
Based Apparel sells T-shirts ($35), “Government Gangster” playing cards ($10), and a “Fight with K$H” scarf ($25). The hack follows two recent security incidents: a March leak of Patel’s Gmail inbox by the Iranian-linked group Handala, and a disclosure that Trump Mobile exposed customer data online. Both incidents illustrate a pattern of security lapses affecting MAGA-associated ventures.
Actors Involved
Key participants include Kash Patel, the former FBI director; Based Apparel, the e-commerce platform; an unidentified attacker who installed a malicious WordPress plugin; and security analysts “debbie,” who first reported the issue, and “WifiRumHam,” who analyzed the malware. Straight Arrow News and San.com reported the findings. The FBI declined to confirm whether it is investigating the hack.
Technical Details and Data Targeted
The malware is an infostealer designed to capture login credentials, browser cookies, data from over 200 cryptocurrency browser extensions, and passwords. A payment skimmer on the checkout page could also steal credit-card details. The code was delivered via a compromised WordPress plugin; the initial access method remains unknown.
Official Responses
Based Apparel did not reply to inquiries. The FBI said Patel had divested from any interest in the store before his confirmation as director and does not profit from its sales. Trump Mobile’s provider acknowledged that customer data had been exposed online.
Criticism
Analysts highlighted the incident as evidence of inadequate cybersecurity safeguards for high-profile personal-brand ventures. The use of a standard Cloudflare verification page to deliver malware was described as a failure to secure the site’s infrastructure.
Conflicting Reports & Gaps
Investigators have not determined how the attacker initially accessed the website, and the FBI has not disclosed whether a formal probe is underway. Straight Arrow News reported no response from Based Apparel, and the site lacks contact information, limiting verification of remediation.
Verbatim Quotes
- “We’ll be right back,” the homepage read. “We’re making improvements to better serve you. The store will be back online shortly — bolder than ever.” — Based Apparel homepage
- “I am not a robot: Cloudflare Verification ID: 801470.” — Altered Cloudflare verification page
- “big time nerd.” — debby, self-described
- “divested from any interest” — FBI statement
Outlook
The temporary shutdown and promise of a swift return suggest operators plan to restore service after addressing the compromised WordPress plugin. Ongoing monitoring by security researchers and potential law-enforcement inquiry will determine whether further vulnerabilities are uncovered.
