White House East Wing demolished Amidst Donation Controversy

October 26, 2025

Washington D.C. – The East Wing of the White House has been fully dismantled, clearing the way for a planned banquet hall expansion initiated by President Donald Trump. The rapid demolition, completed within three days, has ignited a debate surrounding potential conflicts of interest, as the project is being funded by substantial donations from numerous corporations and individuals.

A Historic Structure Removed

The East Wing, originally constructed in 1902 and expanded in 1942, served for over a century as a central hub for social events, ceremonial functions, and housed the office of the First Lady. It also contained a secure underground facility, known as the Presidential Emergency Operations center. Critics have voiced concerns that the destruction of this historically significant building represents a disregard for American heritage and a potentially irreversible alteration of a globally recognized landmark.

donations and Scrutiny

Reports indicate that the construction project has amassed approximately $300 million in funding through donations. President Trump hosted a fundraising dinner earlier this month to solicit contributions from key figures. A list released by CNN reveals a diverse group of donors, including major players in the technology, cryptocurrency, defense, and energy sectors. Companies like Apple, Google, Microsoft, Coinbase, Lockheed martin, and NextEra Energy are among those who have contributed to the project.

The involvement of these companies has raised eyebrows, as many have either benefited from favorable policies under the current administration or stand to gain from future regulatory changes. For example, Google, after settling a legal dispute regarding YouTube content, secured a department of Defense contract related to artificial intelligence. Microsoft has also received over $1.4 billion in federal contracts in recent years.

Allegations of ‘Quid Pro Quo’

Ethical concerns centers around what critics describe as a “quid pro quo” situation, where donations potentially translate into favorable treatment or access to the President and his administration. Richard painter, a former ethics lawyer for President George W. Bush,stated that contributing to the construction appears to be a direct purchase of access to the President. The Financial times has warned that such practices could erode the foundations of a rule-based economy, favoring those with the resources to engage in transactional politics.

Recent events, such as the pardon granted to Binance founder Zhao Changpeng, have further fueled these allegations. The Wall Street Journal suggested the pardon was linked to support for cryptocurrency companies associated with the Trump family.

Did You Know? The White House East Wing’s demolition took only three days, a remarkably swift process that drew immediate public attention and criticism.

Pro tip: understanding the potential implications of campaign finance and lobbying on government decisions is essential for informed civic engagement.

What are your thoughts on the White House renovation and its funding sources? Share your opinions in the comments below!

A refined new Phishing-as-a-service technique, designated ‘CoPhish,’ is leveraging the capabilities of microsoft Copilot Studio to deceive users and pilfer sensitive login credentials. This emerging threat utilizes seemingly legitimate Microsoft domains to deliver fraudulent OAuth consent requests, making it significantly harder for individuals to discern malicious activity.

How CoPhish Works: A Deep dive

Researchers at Datadog Security Labs initially identified the method, raising concerns about the inherent risks introduced by Copilot Studio’s flexible configuration options. The technique centers around creating customized chatbot workflows – known as “topics” – within Copilot Studio.These agents can be openly shared via a “demo website” feature hosted on a genuine Microsoft domain, immediately establishing an air of trustworthiness.

the core of the attack involves manipulating the “Login” topic, responsible for user authentication. Attackers can refine this topic to not only authenticate users but also redirect them to malicious URLs or request verification codes,all while appearing to be a standard Microsoft service.

Targeting Administrators and Circumventing Security Measures

Katie Knowles, a Senior Security Researcher at Datadog, explains that attackers can utilize the Login button to deploy malicious applications, perhaps targeting even those without direct access to the core surroundings. While initial attacks focused on users with limited permissions,the risk extends to administrators. Currently, Microsoft’s security protocols limit the scope of attacks on standard users to OneNote access. However, external attackers can still target Application Administrators using externally registered applications, a loophole that remains unaddressed by current updates.

The attack sequence begins with the creation of a malicious application equipped with the configured sign-in topic, designed to capture session tokens via HTTP requests sent to a Burp Collaborator URL, embedding the access token within a ‘token’ header.The application ID,secret,and authentication provider URLs are crucial elements in setting up the agent’s sign-in parameters. Redirecting users to malicious URLs is a key component,with attackers exploiting the OAuth consent workflow to achieve their goals.

The Attack in Action: From Phishing Email to Token Capture

Attackers distribute these malicious agents via phishing emails or through platforms like Microsoft Teams. Due to the use of legitimate URLs and convincing page designs, users are easily tricked into believing they are interacting with a genuine Microsoft copilot service. A subtle indicator of malicious intent is the presence of the “Microsoft Power Platform” icon,which can be easily overlooked.

If an administrator falls victim to the scheme and approves the malicious app’s permissions, they are redirected to a standard OAuth URL ([token.botframework.com]) to validate the bot connection. Although seemingly routine, this process results in the user’s session token being silently forwarded to the attacker and their session being compromised, all while the connection appears to originate from Microsoft’s trusted IP addresses, masking the malicious activity from standard network monitoring.

Here’s a breakdown of the cophish attack workflow:

Microsoft has acknowledged the issue and has pledged to address the underlying vulnerabilities in a forthcoming software update. A spokesperson stated, “we’ve investigated this report and are taking action to address it through future product updates. While this technique relies on social engineering, we remain committed to hardening our governance and consent experiences and are evaluating additional safeguards to help organizations prevent misuse.”

Share this critical information with your network to raise awareness about the evolving threat landscape and empower individuals and organizations to defend against phishing attacks.