Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users’ passwords during legitimate login attempts.

The technique, dubbed TrustSink by Varonis Threat Labs, can work with any provider that relies on this external authentication model, though the researchers demonstrated the attack using Microsoft Entra.

Microsoft Entra supports external MFA providers, which allow organizations to use third-party authentication services to satisfy multifactor authentication requests.

According to Microsoft, when a user signs in with a first factor, such as a password, Entra can redirect them to an external MFA provider to complete the required second factor.

If the provider returns a valid signed token indicating that the second factor was completed, Entra considers the MFA requirement satisfied.

Varonis found that an attacker who has already compromised a highly privileged Entra account can register a rogue External Authentication Method (EAM) as one of these external MFA providers and use it to insert a convincing Microsoft password prompt into the legitimate authentication flow.

The fake prompt captures the user’s password in plaintext before the malicious provider returns a valid signed token to Entra, causing the login to complete without displaying an error.

“In our test tenant, every sign-in completed normally while our server received passwords with timestamps and source IP addresses,” explains Varonis.

“Resetting a captured password did not remove the rogue provider. It remained in the authentication flow and captured the replacement password at the user’s next sign-in.”

It is important to note that TrustSink is not an initial-access attack and requires an attacker to already control a highly privileged Entra account.

Abusing an external MFA provider

TrustSink abuses the trust Microsoft places in a configured external MFA provider.

Varonis created a malicious provider that appeared to Entra as a legitimate external MFA provider but displayed a copy of Microsoft’s password page to the user.

During the proof-of-concept attack, the login initially proceeds normally, with the user entering their email address and password on Microsoft’s legitimate login.microsoftonline.com site.

When MFA is triggered, Entra redirects the browser to the attacker’s external MFA provider for the second authentication step.

Instead of presenting a legitimate second-factor challenge, the malicious provider displays a copy of Microsoft’s password prompt.

If the victim enters their password again, believing Microsoft is requesting it as part of the authentication process, the credential is sent to the attacker-controlled server.

The rogue provider then generates a signed token stating the MFA prompt was completed and returns it to Entra, allowing the user to continue to the application they originally attempted to access.

From the victim’s perspective, the sign-in appears to have completed normally.

Varonis says the attack is convincing because the fake password prompt appears when the user already expects another authentication step.

The researchers say the page uses the same fonts, layout, and button design as Microsoft’s legitimate login page and appears immediately after the victim enters their real password on Microsoft’s domain.

Varonis says TrustSink builds on previous research by security researcher Dirk-Jan Mollema, presented at x33fcon 2025 in a talk titled “Bringing Your Own Identity in Entra ID.”

Mollema showed how a rogue registered external MFA provider could satisfy an MFA requirement by returning a signed JWT claiming authentication had succeeded without actually performing the expected authentication check.

TrustSink abuses the same attack for credential theft.

Varonis says registering the malicious external method requires modifying the Authentication Methods Policy and creating an application, service principal, and consent grant.

Those actions require a Global Administrator or Authentication Policy Administrator account, making TrustSink a post-compromise technique.

Once installed, however, the rogue provider can remain in the authentication path for targeted users across subsequent logins.

Because the rogue MFA provider remains registered in the tenant’s Authentication Methods Policy, even if a user changes their password, it will be recaptured on the next log in attempt.

Varonis therefore warns administrators to remove the malicious provider before rotating affected credentials.

Varonis recommends removing suspicious external MFA providers and their associated applications, keys, and redirect URIs before resetting affected users’ passwords.

Organizations should also monitor changes to the Authentication Methods Policy, limit standing Global Administrator and Authentication Policy Administrator privileges, and use phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

from the bringing-out-the-worst-in-America dept

Ever since Trump’s return to office, almost every federal law enforcement agency has been ordered to treat illegal immigration as their first priority. This is why the administration is gutting FEMA to direct more dollars to detention and removal efforts. And that’s why ICE is now the administration’s largest law enforcement budget line item.

To keep up with moving (and ever-increasing) deportation targets, the government has done everything from dismissing pending immigration hearings to stripping temporary protected status from thousands of vulnerable people to the very thing that has been rejected by hundreds of federal judges in thousands of cases.

The administration claims the 1996 Illegal Immigration Reform and Immigrant Responsibility Act (IIRIRA or IRA, depending on which titles judges choose to use) gives it the power to treat any migrant — no matter how long they’ve been in the country — as someone who has been accosted while attempting to cross the border. Migrants who are slated for removal are generally given due process rights if they’re not arrested while attempting border crossings. Trump’s DOJ and DHS have constantly pushed the theory that due process rights do not apply to undocumented immigrants, no matter where they’re arrested or how long they’ve lived in the United States.

As the law stands — at least in terms of how it has been interpreted for the past 30 years — arrested migrants are supposed to receive a bond hearing and be released if they pose no threat of flight or to public safety. The administration goes hard in the other direction, pretending constitutional rights don’t apply to migrants. But it has repeatedly demonstrated it doesn’t even believe its own bullshit. That’s why arrested migrants are swiftly moved from where they’re arrested and shuffled from detention center to detention center to prevent them from filing habeas motions, which must be filed in the jurisdiction in which they were initially arrested.

So far, eight of eleven appellate circuits have ruled in favor of due process rights and against the administration’s desire to pretend the Constitution no longer exists simply because it has expressed a very novel interpretation of the 1996 law.

This loss in the Fourth Circuit brings the total to nine of eleven circuits. And this means the Supreme Court is going to be asked to sort this out, which isn’t exactly heartening. But here are some details on the latest, rather large loss by the Trump administration, as summarized by Politico’s Kyle Cheney:

A federal appeals court on Thursday rejected ICE’s effort to detain millions of people without bond, comparing it to the “historical stain” of Japanese internment during World War II.

“Mass detention of marginalized individuals without due process harkens back to some of the darkest moments in our country’s history,” 4th Circuit Court of Appeals Judge Nicole Berner, a Biden appointee, wrote in a 2-1 majority opinion joined by Judge Barbara Keenan, an Obama appointee.

There it is. The same people who excuse past racism as being a product of a “different time” are doing everything they can to revive this “different time” in the present and make it the “new normal” going forward.

The decision [PDF] notes that this legal action has been brought by two migrants who cannot truly be considered “recent” crossers of the border who were caught in the act of illegal entry. One of the plaintiffs has been here since the law the administration is now deliberately misquoting was first enacted (1996). The other plaintiff is far from a US rookie, having lived here peacefully and productively since 2005.

The government could not be more wrong. And this court isn’t willing to bless a self-serving interpretation that seeks to Make America 1942 Again.

Putting all of our tools of statutory construction to work, we hold that Section 1226, not Section 1225, applies to noncitizens who, like the Petitioners, have been present in the United States for years regardless of how they entered our country. Our holding accords with the text, structure, context, and purpose of the INA [1952’s Immigration and Nationality Act] as well as its universally accepted application for the past three decades. Though the Government’s construction finds some support in the text, it suffers several fatal defects. It renders entire portions of the INA meaningless, calls into question amendments to the statute in the intervening decades, including the recent passage of the Laken Riley Act, and raises significant constitutional concerns.

If we were to agree with the Government’s construction, we would need to conclude that, in passing IIRIRA thirty years ago, Congress intended to direct the single largest mass detention of human beings in our nation’s history. Section 1225 simply “cannot bear the weight of the millions of noncitizens it would potentially subject to detention without bond.”

This administration unabashedly does want courts to agree with its interpretation of the law and it definitely wants to engage in the “single largest mass detention of human beings in our nation’s history.” It doesn’t see this as problematic. Instead, it considers the courts’ nearly-100% rejection of its theories to be the real problem here. In response, it has chosen to directly insult and threaten judges, rather than craft any better arguments in support of its openly racist actions.

While this does put almost every circuit in opposition of the president and his efforts, it does make it clear a showdown in the Supreme Court is all but inevitable. Unfortunately, this iteration of the Supreme Court has repeatedly demonstrated that it believes the president should be able to unilaterally declare how laws should be interpreted, if not able to override them completely by simply issuing an executive order. The conservative majority of the court will undoubtedly do everything it can to prop up decisions delivered by the appellate exceptions to the rule.

Filed Under: 14th amendment, 4th circuit, bigotry, doj, ice, mass deportation, mass detention, trump administration

Apple has expanded Tap to Pay on iPhone to eight additional countries in Latin America, allowing businesses to accept contactless payments without dedicated payment terminals.

The expansion brings Apple’s payment acceptance feature to Argentina, Colombia, Costa Rica, the Dominican Republic, Guatemala, Honduras, Panama, and Peru. It gives businesses a way to accept cards, Apple Pay, and other contactless wallets using only a compatible iPhone and supported app.

Tap to Pay on iPhone works with the iPhone XS and newer running the latest version of iOS. Customers can hold a contactless debit or credit card, iPhone, Apple Watch, or another supported digital wallet near the merchant’s iPhone to complete a payment over NFC.

According to a post on Apple’s Latin American site, first spotted by 9to5Mac, Apple is launching the feature via several payment platforms across eight countries, although availability varies. The initial rollout includes:

• Argentina: Mercado Pago
• Colombia: SumUp, Symbiotic
• Costa Rica: Geopagos, Symbiotic, Visa Acceptance Solutions
• Dominican Republic: Azul, Visa Acceptance Solutions
• Guatemala: Geopagos, Symbiotic
• Honduras: Geopagos, Symbiotic
• Panama: Geopagos, Symbiotic
• Peru: SumUp

Contactless cards from major payment networks including American Express, Mastercard, and Visa are supported. Apple first rolled out the feature in 2022.

The Questyle M18i Max is a compact USB DAC and headphone amplifier designed to solve a familiar problem for listeners using a phone, tablet, or computer: how to get genuinely high-quality headphone performance without adding a traditional desktop stack. Questyle has built its reputation around current-mode amplification, a technology the company has used across its home and portable products for years, and the M18i Max brings that approach to a far more portable package.

The focus here is different from much of the current portable audio market. Many dongle DACs are inexpensive, tiny, and designed primarily for convenience. Questyle takes a more ambitious approach. At $399, the M18i Max is larger, more powerful, and more expensive, but it also attempts to deliver the kind of refinement normally associated with a dedicated desktop component.

The M18i Max is not intended to be a disposable dongle or merely a replacement for a missing headphone jack. It is designed as a serious source component, with the power, connectivity, and sound quality to serve as the center of a portable headphone system.

Related Reading:

Design & Build Quality

The M18i Max uses a compact aluminum chassis and glass faces with a well-machined look. Buttons down the side are machined as well, and are both well-fitted and tactile. Ports are precisely fitted into the aluminum frame, with no play or slop, giving the unit a very premium feel. The design is understated, relying on the visibility of the components through the glass rear face to generate visual interest.

Size-wise, the M18i Max splits the difference between a dongle and something like the Cayin CU9 at roughly 4 inches tall, 2 inches wide, and ½ inch thick. Sporting an 1,800 mAh internal battery also removes it from the category of typical dongles. As a result, the weight is also a bit more than most dongles at 100 grams. That additional size and weight is a trade-off for longer battery life and greater potency. The M18i Max is designed to provide greater output capability than a basic dongle.

The color display provides useful information, including volume, sample rate, output status, and playback format, although my aging eyes would have preferred about a four-point larger font. That may seem like a small detail, but it is helpful when switching between phones, tablets, and computers, where software volume controls are not always obvious. The screen also makes the M18i Max feel more like a complete audio component and less like an adapter hanging from the bottom of a phone.

The independent volume control allows precise adjustment directly from the unit rather than relying entirely on the source device. This also allows the source device volume to be set at 100% where software volume controls might otherwise affect sound quality before passing the signal off to the M18i Max. Listeners accustomed to a traditional analog knob may initially find the button-style interface less immediate, but the controls are logical after a short period of use.

Internals

Inputs include USB as well as Bluetooth 5.4, with support for Bluetooth LE, LDAC, aptX HD, aptX Adaptive, and SBC. It is also worth noting that most, if not all, Questyle products in the current lineup are MFi-certified, so they will work equally well with Apple and Android products. A switch on the side of the unit allows listeners to control the operating mode and whether the device should charge from the source, so phone batteries can be protected while the M18i Max can still charge directly from a laptop. A separate USB charging port also puts the unit into phone mode when connected to a USB source and the power port is connected.

The DAC section uses two ES9219Q chips that provide dual-mono processing to further reduce noise and improve channel separation. The design supports high-resolution PCM up to 384 kHz/32-bit and DSD256 playback, well beyond the requirements of most of my music library and many streaming services.

The M18i Max uses two of Questyle’s proprietary SiP amplifier modules containing four patented Current Mode Amplification circuits. These SiPs, as Questyle calls them, are designed to provide high bandwidth, low distortion, and strong control over connected headphones. Books have been written on the topic of current-mode versus voltage-mode amplification, but it is hard to deny that Questyle has found a way to make it work. The company specifies distortion as low as 0.0002% under an actual 300-ohm load, along with a peak output current of 1.5A.

This is more than adequate power for headphones like the HEDD D1 or Sennheiser HD 650, while still providing enough finesse to handle sensitive in-ears like the Campfire Andromeda or Beyerdynamic DT 70. The one limitation is large planar headphones, with inefficient models like the Fostex T50RP and HiFiMAN HE6 acting as current sponges and draining the resources of the M18i Max quickly. The M18i Max closes the gap between portable and desktop performance, but it does not eliminate the distinction entirely.

The M18i Max includes both 3.5mm single-ended and 4.4mm balanced outputs. The balanced connection is the preferred output for demanding headphones or listeners who want the greatest amount of headroom.

Listening

The first thing that stands out about the M18i Max is its sense of control. It does not radically alter the tonal balance of a connected headphone, but it gives the impression that the driver is being managed more effectively.

Bass is tight and well-defined, with good extension into the sub-bass region. Kick drums have a clear leading edge, and electric bass lines remain easy to follow in busy arrangements. The M18i Max does not add a large bass lift, which will disappoint listeners expecting a warmer or more obviously colored presentation. What it provides instead is authority and separation.

Sub-bass information is easier to recognize with the M18i Max than through the headphone outputs of many phones and laptops. Electronic music benefits from the additional depth, but the improvement is equally apparent with acoustic recordings, where the lower registers of piano, double bass, or organ need room to develop.

The additional power is most obvious with full-size headphones. The M18i Max maintains its composure when the music becomes dense or the volume rises, and it avoids the sense of strain that can appear when a small amplifier is pushed beyond its comfort zone.

The midrange is clean and transparent. Vocals are well-centered, and small differences in recording technique are easy to hear. Male voices have weight without sounding thick, while female vocals retain texture and air without becoming artificially forward. Acoustic guitars have good body and string definition, and piano notes carry enough harmonic information to sound natural rather than mechanical.

The M18i Max is not warm in the traditional sense. It does not soften the edges of a bright headphone or add much coloration to a neutral one. That makes it a good match for listeners who want to preserve the character of their headphones, although those already using an aggressive or analytical model may prefer a warmer amplifier.

Treble is extended and detailed without sounding excessively sharpened. Cymbals have convincing attack and decay, and low-level information in recordings is easier to follow. The M18i Max offers a largely effortless presentation in the upper registers, particularly with demanding headphones, but it does not turn detail into an excuse for brightness.

Poor recordings remain poor. Compressed pop material can still sound flat and congested, and bright masters can become tiring with already-forward headphones. The M18i Max is resolving enough to expose those flaws, although it generally avoids adding harshness of its own.

The soundstage is more open than what most phones and computers can provide from their internal outputs. Width improves first, with depth and image layering becoming more apparent as the quality of the headphones increases.

Instrument placement is stable, and complex recordings remain organized at higher listening levels. Orchestral recordings benefit from the improved separation. Placing the orchestra is relatively straightforward, and individual sections retain their identity rather than blending into a single mass.

Small jazz ensembles are handled especially well, with enough space around the instruments to make the recording feel less congested. Live recordings also benefit from the additional control, particularly when crowd noise, room ambience, and the performers occupy overlapping parts of the mix.

The 4.4mm balanced output provides the strongest performance. It offers more headroom and a greater sense of ease, particularly with full-size headphones. The 3.5mm output remains very capable with IEMs and efficient portable headphones, but the balanced connection allows the M18i Max to show more of its potential.

Headphone & IEM Pairing

The M18i Max is a flexible match for a wide range of headphones. It works especially well with neutral and slightly warm models, providing enough clarity and control to keep warmer headphones from sounding sluggish while avoiding the exaggerated brightness that can make neutral models difficult to tolerate.

With sensitive IEMs, the quiet background and low output impedance are important advantages. The M18i Max preserves the character of the earphones rather than imposing a strong tonal signature of its own.

The extra power becomes more valuable with full-size dynamic headphones and planar models. The M18i Max provides better headroom and a more effortless presentation than most conventional dongle DACs, particularly through its balanced output.

Listeners should still maintain realistic expectations. “Powerful for a portable DAC” and “powerful enough for every headphone” are not the same thing. The M18i Max is capable, but the most inefficient headphones will still be better served by a dedicated desktop amplifier.

Portability & Everyday Use

The M18i Max is straightforward to use with computers and most modern mobile devices. It can function as a high-quality USB audio output for streaming services, local music libraries, and high-resolution playback software.

Battery life is an important consideration because the M18i Max is more sophisticated than a basic dongle DAC. The display, amplification stages, and higher output capability all require power, and the unit can draw more from a connected phone than a simpler adapter.

That is not a reason to reject the product, but it does make the M18i Max better suited to deliberate listening than casual, all-day use. A small power bank may be useful for longer sessions away from a wall outlet.

There is also the question of portability. The M18i Max is compact compared with a desktop stack but relatively large compared with inexpensive dongle DACs. It may hang awkwardly from a phone in a pocket, especially with larger headphone cables attached.

The M18i Max is aimed at the listener who is willing to accept some inconvenience in exchange for stronger performance. That is a reasonable trade, but it is still a trade. The unit is more portable than a desktop system but less convenient than a simple phone adapter.

What Could Be Better

The price is the most obvious concern. The M18i Max costs considerably more than many competent USB DACs, and listeners using efficient IEMs may not immediately hear enough of an improvement to justify the difference.

Battery consumption is another consideration. The M18i Max is not as carefree as a simple passive adapter, and phone users will need to account for the additional drain during extended sessions.

The unit can also be more complicated than some listeners need. High-resolution format support, multiple output modes, a display, and a powerful amplifier are useful features, but not everyone needs a miniature audio laboratory attached to a smartphone.

Its physical size is another compromise. The M18i Max is very portable compared with a desktop stack, but listeners looking for the smallest possible solution will find less expensive and more convenient options.

Finally, the M18i Max’s clean and controlled sound will not suit every system. Listeners looking for warmth, tube-like coloration, or a more forgiving presentation may prefer a DAC and amplifier with a more obvious sonic personality.

The Bottom Line

The Questyle M18i Max occupies an interesting middle ground. It is considerably more substantial than a conventional dongle DAC, but still small enough to travel without turning your phone into a science project. Its real advantage is Questyle’s Current Mode Amplification combined with dual-mono ES9219Q DACs, a dedicated 1,800 mAh battery, Bluetooth 5.4, and both 3.5mm and 4.4mm outputs.

That combination matters more than chasing another decoding format. The M18i Max can drive sensitive IEMs quietly, provide considerably more authority with full-size headphones, and operate from its own battery rather than treating your phone as a power supply. It still has limits with genuinely inefficient planar headphones, so anyone expecting a pocket-sized replacement for a powerful desktop amplifier is buying the wrong product.

What is missing? There is no PEQ, meaningful DSP suite, or app-based control, which competitors from FiiO and others increasingly offer at this price. The display and physical controls keep operation straightforward, but listeners who want to endlessly tweak filters, EQ curves, and presets will find the M18i Max rather old-school.

That is also part of its appeal. The M18i Max is for someone who already owns very good headphones or IEMs and wants to hear more of what they can do without carrying a desktop rig. At $399, it is overkill for inexpensive earbuds and harder to justify for anyone primarily interested in convenience. For the listener who values sound quality, low noise, strong headphone control, and genuine portability more than software features, however, the M18i Max makes a very persuasive case.

Pros:

• Excellent control and low noise with both full-size headphones and sensitive IEMs
• Current Mode Amplification delivers strong dynamics, separation, and composure
• Clean, transparent tonal balance without excessive brightness
• Dual-mono DAC architecture with 3.5mm and 4.4mm outputs
• Dedicated battery reduces dependence on the source device

Cons:

• Expensive compared with conventional dongle DACs
• Larger and heavier than most portable USB DACs
• No PEQ, advanced DSP, or app-based control
• Can still struggle with very inefficient planar headphones
• Overkill for listeners using inexpensive or easy-to-drive earphones

Our Ratings:

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Build Quality

★★★★★★★★★★ Portability

★★★★★★★★★★ Value

Where to Buy:

Related Reading:

This article is brought to you by CoolIT, an Ecolab Company.

Beyond 250 kW a server rack can no longer be cooled by a hybrid approach of liquid and air. At this density a 70/30 liquid-air split leaves 75 kW of air load. The air cooling system needed to move it brings cost and complexity few operators will accept. The answer is near-total heat capture. Liquid takes effectively all the heat, air falls below 1 percent of the load, allowing the server to run fanless.

CoolIT builds these loops today from modular coldplate blocks proven across six generations of fanless designs. Processor thermal design power (TDP) keeps climbing generation over generation. This rising heat load is now cascading into the memory, networking, storage, and power components that once ran comfortably on air.

The heat escaped the chip

For years the story stayed simple. Cool the processor and let air handle the rest. That balance has shifted. As TDP climbs, heat spreads outward from the processor and cascades into the components around it. Memory, networking, storage, and power now run hot enough to demand liquid of their own. Engineers designing the next generation of AI servers face a board where heat capture rises with every launch.

Beyond 250 kW per rack, air cooling becomes the bottleneck. Near-total liquid heat capture enables fanless AI server designs built for the next generation of computing.

New parts, new rules

Unlike processors, which are cooled as flat rectangular packages, these peripherals come in a wide range of shapes, sizes, and mounting requirements, each with its own thermal limits. Some run cooler than the processor case temperature, others run hotter, which leaves them sensitive to a design tuned only for CPUs and GPUs. Operators need purpose-built solutions here, matched to the part rather than stretched across the board.

CoolIT engineers meet this with a deep toolkit. Conductive plates, vapor chambers, heat pipes, and thermal transfer plates move heat from components closer to the liquid path. Riding coldplates enable pluggable components. Each solution stays true to the component it serves.

CoolIT Customer Showcase: How GWDG Cools HPC & AI Systems with CoolIT’s Direct Liquid Cooling CoolIT

One loop, one server

Cooling the parts is one challenge. Uniting them is the real work. Full heat capture means folding every one of these solutions into a single server loop that distributes coolant effectively and remains easy to install. Connection reliability, coolant routing, and the time it takes to assemble the loop at rack integration determine whether a design thrives in production or stalls on the bench. CoolIT builds these loops from proven modular blocks, so operators gain performance and deployment speed within the same solution.

Density forces the decision

Rack power continues to climb toward 1 MW, and the case for liquid grows stronger at every step. A 70/30 split of liquid to air holds comfortably at lower density. Past roughly 250 kW it stops working. The 30 percent left to air becomes a 75 kW load inside a single rack, and moving that much heat demands a parallel air system whose cost and footprint few operators will accept. Adding density only widens the gap.

As rack power continues to climb toward 1 MW, CoolIT’s modeling places full heat capture as the standard server design for flagship rack-scale products through 2028.

The simpler, more efficient answer is to capture the heat in liquid and drop air to less than 1 percent of the total load. True 100 percent remains almost impossible to reach in the strictest sense, so the honest and achievable target is near-total capture. That distinction matters to engineers who value precision, and the direction stays clear either way. Full heat capture moves from a premium option to a mainstream requirement as density rises, and CoolIT’s modeling places it as the standard server design for flagship rack-scale products through 2028.

CoolIT delivers it

CoolIT scales heat capture all the way to 100 percent using modular coldplate building blocks proven across six generations of fanless server designs. Engineering teams are already working on designs for the maximum density racks coming next. As the cascade spreads and racks grow denser, near-total heat capture becomes the design that keeps AI running.

Talk to CoolIT about building a server loop engineered for total heat capture.