The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts.

Despite an international law enforcement operation disrupting the Tycoon2FA phishing platform in March, the malicious operation was rebuilt on new infrastructure and quickly returned to regular activity levels.

Earlier this month, Abnormal Security confirmed that Tycoon2FA had rebounded to normal operations and even added new obfuscation layers to strengthen its resilience against new disruption attempts.

In late April, Tycoon2FA was observed in a campaign that leveraged the OAuth 2.0 device authorization grant flows to compromise Microsoft 365 accounts, indicating that the operator continues to develop the kit.

Device code phishing is a type of attack in which threat actors send a device authorization request to the target service’s provider and forward the generated code to the victim, tricking them into entering it on the service’s legitimate login page.

Doing so authorizes the attacker to register a rogue device with the victim’s Microsoft 365 account, giving them unrestricted access to the victim’s data and services, including email, calendar, and cloud file storage.

Push Security recently warned that this type of attack has increased by 37x this year, supported by at least ten distinct phishing-as-a-service (PhaaS) platforms and private kits. A more recent report by Proofpoint records a similar surge in the use of the tactic.

Tycoon2FA adds device-code phishing

According to new research from managed detection and response company eSentire, Tycoon2FA confirms that device code phishing has become highly popular among cybercriminals.

“The attack begins when a victim clicks a Trustifi click-tracking URL in a lure email and culminates in the victim unknowingly granting OAuth tokens to an attacker-controlled device through Microsoft’s legitimate device-login flow at microsoft.com/devicelogin,” explains eSentire.

“Connecting those two endpoints is a four-layer in-browser delivery chain whose Tycoon 2FA tradecraft is virtually unchanged from the credential-relay variant TRU documented in April 2025 and the post-takedown variant documented in April 2026.”

Trustifi is a legitimate email security platform that provides a range of tools integrated into various email services, including those from Microsoft and Google. However, eSentire does not know how the attackers came to use Trustifi.

According to the researchers, the attack uses an invoice-themed phishing email containing a Trustifi tracking URL that redirects through Trustifi, Cloudflare Workers, and several obfuscated JavaScript layers, landing the victim on a fake Microsoft CAPTCHA page.

The phishing page retrieves a Microsoft OAuth device code from the attacker’s backend and instructs the victim to copy and paste it to ‘microsoft.com/devicelogin,’ after which the victim completes multi-factor authentication (MFA) on their end.

After this step, Microsoft issues OAuth access and refresh tokens to the attacker-controlled device.

The Tycoon2FA phishing kit includes extensive protection against researchers and automated scanning, detecting Selenium, Puppeteer, Playwright, Burp Suite, blocking security vendors, VPNs, sandboxes, AI crawlers, and cloud providers, and using debugger timing traps.

Requests from devices indicating an analysis environment are automatically redirected to a legitimate Microsoft page, eSentire says.

The researchers have found that the kit’s blocklist currently contains 230 vendor names and is constantly updated.

eSentire recommends disabling the OAuth device code flow when not needed, restricting OAuth consent permissions, requiring admin approval for third-party apps, enabling Continuous Access Evaluation (CAE), and enforcing compliant device access policies.

Additionally, the researchers recommend monitoring Entra logs for deviceCode authentication, Microsoft Authentication Broker usage, and Node.js user agents.

eSentire has published a set of indicators of compromise (IoCs) for the latest Tycoon2FA attacks to help defenders protect their environments.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Advertisement

Download Now

Finally, we know that plug-in solar systems are finally coming to the UK at some point soon, but so far, the lead headlines from the nationals have been about the supermarket chains that will fill the aisles with £400 systems that you can take away and connect yourself.

While all systems sold must meet safety requirements, there’s a lot more to consider, including how much energy you want to generate, installation requirements, and whether you need a battery.

After seeing the new Anker SOLIX Solarbank 4 E5000 Pro (freshly launched and available in Germany), it’s clear that the talk about plug-in solar in the UK has been oversimplified, and that it will be more important to buy the right system rather than the cheapest.

Solar panels might not be straightforward to install

Plug-in solar is often also referred to as balcony solar. Many of the systems are designed to use thin, light solar panels that are tied to the front of a balcony, connecting via an inverter to a regular power socket.

Sounds easy, but even a lightweight solar panel is around 8kg, and it needs to be secured properly to avoid falling off. Before I buy any system, I’d want to double-check the installation instructions and make sure they all make sense, and you’re more likely to get that from a bigger manufacturer.

While balcony solar is one option, plug-in solar is also designed for use with panels ground-mounted in a garden or mounted on a flat roof, such as a garage or garden office. These alternative mounting options need frames to angle the panels towards the sun, and this needs to be made clear at the point of purchase.

I think there’s a real danger that systems will be bought, because people think they’re plug-in and easy to install, but the reality will be that some installations will be more complicated, and you might even want to pay a professional to do the work to get it right.

While a lower price may seem good, that’s not the only metric: a solar panel’s wattage is important. Wattage is measured using Standard Test Conditions (STC), so it isn’t the amount of power generation you’ll see, but how much power a panel can produce in ideal conditions. It’s still a useful metric: the higher the wattage the more power you’ll generate from the sun. This metric has nothing to do with physical panel size, either, as two identically sized panels can have a different rated Wattage.

My guess is that cheap systems will use older, lower-power panels, so you’ll see less benefit from them.

Be careful of cheap batteries

According to research from global business insurer, QBE, the UK fire brigades are tackling a lithium-ion fire every five hours (or 4.8 fires per day). Most fires were from ebike batteries, with converted or retrofitted models the cause of the majority.

What this statistic shows is that Li-ion batteries can be dangerous. If I bought a plug-in solar system with a battery, I would only buy from a reputable vendor with specialist knowledge in this kind of market, particularly for any batteries placed outside.

With the Anker SOLIX Solarbank 4 E5000 Pro, for example, you get C5-M anti-corrosion (the highest protective coating rating), a guarantee that it will operate in temperatures down to -20°C, and an IP66 rating (fully protected against dust and protection from high-pressure water jets). This system, and ones from other reputable manufacturers, are fully designed to be installed outside, and I wouldn’t buy an outdoor battery system with lower ratings to avoid fire damage.

Batteries have other important metrics, too: capacity, depth-of-discharge, and the number of charge cycles they’re rated for. With the Anker SOLIX Solarbank 4 E5000 Pro, you get a base 5kWh capacity, which is roughly around half the total power that a typical UK household will use in a day.

This system is rated to last for 10,000 charge cycles at a 100% depth of discharge. So, what does that mean?

A charge cycle is when the battery is charged and then discharged. The higher the number of charge cycles, the longer the battery will last for, which means you can store more power in total before the battery has to be replaced.

Alongside the number of charge cycles is the rated depth of discharge. Many batteries are rated at 90% depth of discharge, which means that each charge cycle uses only 90% of the rated capacity, with the remaining 10% unused.

The Anker SOLIX Solarbank 4 E5000 Pro, you get 100% depth-of-discharge, so all of that capacity is available. 

Before buying any solar battery, it’s important to know what to expect, how long the system will last and how much power it can hold. It’s then, the cost over a product’s lifetime that’s important. For example, Anker says that its new system has a payback time of just three-years.

And, it’s an expandable system. You can add up to 30kWh of battery storage, using the stackable design, and add up to 12 solar panels for a total 5kW input. With cheaper systems, you’re likely to be stuck with what you get in the box, with no expansion available.

The current change to regulations only talks about 800W input

Currently, although the UK government has said plug-in solar will be available soon, the regulations are not in place. That makes life difficult for the manufacturers, as it’s not clear what they’ll need to do to any products to make them compatible with the UK. That’s true of the Anker SOLIX Solarbank 4 E5000 Pro, which will be sold in the UK, although whether the maximum output can be used isn’t yet clear.

If we look at Germany, plug-in solar devices that connect to a standard Schuko socket are limited to an 800W output. However, have a Wieland socket installed by an electrician, and the Anker SOLIX Solarbank 4 E5000 Pro can have its full 2500W output enabled.

In the UK, the government has said that it’s working “with the Energy Networks Association, DNOs and Ofgem to update the G98 distribution code and wiring regulations BS 7671 to allow UK households to connect <800W plug-in solar panels to domestic mains sockets, without the need for an electrician and with tailored safety standards.”

What isn’t clear is whether higher power output will be available if the system is professionally installed. 

That’s potentially quite a big difference. With an 800W output, you can trickle power into your home for smaller appliances, but when you exceed this limit, you’ll have to buy power in. With 2500W, you can power pretty much anything in your home, up to a lot of ovens, so you can use all of the free power you’ve generated.

If the UK regulations allow for higher power inputs, and you’ve got space to put a decent number of solar panels, having a system that can feed more power in may well be worth it, even if that will be a future update as regulations evolve.

I should point out that the Solarbank 4 E5000 Pro has a neat trick, in that you can directly plug a device into its 2500W input, say, powering your washing machine directly from the battery.

Intelligent power usage is just as important

As noted before, when I talked about whether solar panels are worth it in the UK, it’s important to maximise solar power usage. For example, running a washing machine cycle when there’s excess power.

With a battery, it gets more complicated, as you want to balance charging it with solar and also use an anytime-of-use tariff to access cheap electricity. With budget systems, you’ll have to handle all of this yourself. 

With a more expensive system, you don’t just get the hardware, but software behind it. Using AI, with inputs from how you use power, the weather forecast and more, the system can optimise your plug-in solar, maximising free energy for charging, but balancing this out with any time-of-use tariff that you have.

This level of intelligence can help unlock better savings and make any system deliver more.

Rather than just going for the lowest price for a plug-in solar system, it’s more important to get one that has a longer life, better warranty, wider installation options (with help if needed), and the option to expand to meet future needs.

It’s that time of the year when Trusted Reviews rolls its sleeves and starts testing TVs. Starting from April, it’s usually the time when TVs roll off the production line and into test rooms for a closer look.

Samsung’s flagship models have already been looked at, while I have started to look at LG’s G-series OLED (with the C-series coming soon). Sony has announced a couple of its lower-tier sets, while I’ve also started testing at Hisense’s RGB Mini LED screens, and hopefully TCL’s new models will follow suit later in May.

But there are two brands I haven’t yet covered. One is Panasonic, which I suspect will enter the market later in the year after the seismic changes that have been made with its TV and home cinema division. The other is Phillips, who announced forthcoming sets back in February, but it’s been whisper-quiet on any review samples.

Phillips tends to launch its TVs in waves, but I do wonder whether it’s leaving out of sync with other launches.

Out of sync

Every TV brand has its launch cycle. Sony tends to be in 18-month cycles (sometimes even two years for its more premium TVs), LG, Samsung, Hisense and TCL are yearly, Panasonic appears to be moving to a different, longer cycle.

Philips launches flagship TVs almost every six months to eight months.

This can get confusing, as by the time I’ve received a review sample for one telly, it’s almost time for the other to go on sale. From my perspective, this can be hard to ingest, especially when it comes to reviewing, as there’s always another model on the horizon; a TV that’s likely to be better specc’d and offer better performance.

But the current TV is likely to have come down in price and offer better value. How do you judge it? In the end, the TV has to be judged on its own merits and now in light of what’s coming down the line.

I think the Philips OLED+910 is an absolute cracker of a TV. The picture quality, aside from a few problems, is one of the best I’ve seen from an OLED in recent years; while the sound quality trounces that of LG and Samsung, and it does so fat a price that’s less expensive than most of its rivals.

But do you stick and go for the OLED+910, or decide to wait for the OLED+911 that’s set to launch in June? Philips is very consistent in terms of quality – it’s rarely delivered a stinker of an OLED TV – but launching these premium TVs on a six-month cycle has to cause them some pain. You can get the OLED+910 but if you find out that the OLED+911 is even better (and costs similar), would that lead to a sense of buyer’s remorse?

The quality of the TVs themselves may lead to people simply being satisfied with their purchase, but perhaps it’s not really how often Philips updates its premium models that’s the problem; it’s a case of when they launch that’s the biggest issue.

Overshadowed by other TV brands

By now, LG and Samsung TVs will be available in stores, while Sony seems to have put some effort into getting most of its TVs into stores around the same time. Hisense and TCL will soon be available if not already available online and in stores, and this leaves Philips at a disadvantage because obviously, it’s launching later than others.

Some will have already planned their purchases and made them. If you’re waiting on reviews, it could be some time before they’re published, as I’ve found that it does take some time for Philips to get their ducks in a row and distribute review samples. We could potentially be looking at September for reviews, by which time, that’s a long time if you’re itching to purchase a new TV.

It doesn’t help that other manufacturers will be lowering their prices (in fact, that doesn’t help them either), but at least it gives them a competitive advantage because if you have been waiting for a price for an LG or Samsung OLED, you’re likely to be more eager to get it once the price has dropped. Philip takes the approach of undercutting the likes of LG, Samsung and Sony, but in some cases that undercut isn’t as strong once prices have gone down across the board.

It also means that Philips isn’t really involved in the discussion when it comes to new developments in TV technology. The innovations it drives tend to be lost among the marketing campaigns of others. Conceivably, if they launched at the same time, that could still be a problem – but rather than being separate from these announcements, it’d be grouped as part of the whole.

Right now Philips feels like an island off to the side, while there’s a continent of stuff happening elsewhere that’s casting a shadow over Philips.

An ace up its sleeve?

Philips will be launching with a feature that others seem to be skipping, and that is Dolby Vision 2 HDR.

Samsung doesn’t support Dolby Vision and came up with its own rival in HDR10+ Advanced. LG isn’t supporting it, and Sony hasn’t announced anything as of yet, and neither has Panasonic, leaving Chinese brands such as Hisense and TCL with the field to themselves. Philips is the only European TV brand to announce its interest in Dolby’s new HDR format.

But how much of an ace will it be if there’s nothing in Dolby Vision 2 to watch? Dolby has said that it can upscale original Dolby Vision content in some ways, but some upgrades are locked to Dolby Vision 2.

There’s still no word on when it will launch other than later in 2026 (which might suit Philips’ release dates more) but perhaps with the launch of the HDR format, that’s a conversation that Philips can be a part of and drive.

But who’s to say whether the addition of Dolby Vision 2 will drive people’s interest and sales? It may take time for the format to find its groove and appeal.

Philips isn’t likely to change its approach anytime, but one wonders whether it should. A new TV season generates interest and discussion, and Philips being a part of it rather than away is a positive. That the brand would be compared with others and featured in round-ups should only strengthen the brand rather than weaken it. Its flagship TVs are more than a match for the likes of Samsung and LG – why not take them on in a head-to-head?

I reckon Philips would triumph more often than people might think. But in order for that to happen, that release schedule needs some more finesse.

Modern gaming has somehow normalized the idea that publishers can permanently shut down games people already paid for. Thankfully, California is now trying to push back against that with its proposed “Protect Our Games Act,” which has officially cleared another key legislative hurdle with strong backing from the Stop Killing Games movement.

California’s new bill could force publishers to preserve online games

If passed in its current form, the legislation would require publishers to either keep games playable after official support ends, provide an offline patch, release a standalone playable version, or issue refunds to players. The bill would reportedly apply to paid games released after January 1, 2027, while free-to-play and subscription-only titles would remain exempt.

The movement gained major traction after Ubisoft shut down The Crew in 2024, effectively making the game inaccessible even for players who had already purchased it. That incident became a rallying point for preservation advocates, arguing that modern online games are increasingly being treated like temporary rentals rather than products consumers actually own.

“The bill is based on a false premise: that consumers ‘own’ digital games with permanent access. That is not how software works-games are licensed, not sold as unrestricted property.” – ESA

Publishers and industry groups are obviously not thrilled, with the ESA arguing that indefinite support requirements could become technically and financially unrealistic for developers. Interestingly, preservation groups previously accused the ESA of lobbying against expanded DMCA exemptions for preserving older video games back in 2024.

Honestly, gamers are finally questioning what “buying” a game even means now

The bigger reason this bill matters is that it taps directly into growing frustration around digital ownership. Over the last few years, gamers have slowly realized that many “purchased” online games can effectively vanish overnight if servers disappear. Ironically, California itself already pushed the industry toward more transparency last year by forcing digital storefronts to clarify that users are often buying licenses instead of permanent ownership. Steam even added warnings explaining this directly before purchases.

At this point, the entire debate feels bigger than just preserving old multiplayer games. It’s becoming a fight over whether players actually own anything in the digital era, or whether publishers can simply decide when products stop existing. And honestly, judging by how aggressively communities have rallied behind Stop Killing Games, a lot of players seem very tired of feeling like long-term rentals disguised as customers.

There was a time when VPNs were mostly associated with office workers logging into company servers or people trying to watch region-locked Netflix libraries. Now, they’ve somehow become one of the internet’s most politically sensitive tools.

Mozilla is the latest company sounding the alarm, warning UK regulators that VPNs remain “essential privacy and security tools” that should not be weakened or treated like suspicious circumvention software. The statement comes amid growing debates around online age verification systems, content controls, and broader internet regulation across Europe and beyond.

Mozilla says weakening VPNs could seriously hurt online privacy

In its latest policy push, Mozilla argues that VPNs are critical for protecting users from surveillance, cyberattacks, and invasive data collection. The company also warned regulators against creating laws or technical frameworks that indirectly discourage VPN usage or make them harder to access.

The timing here is important. Several governments are increasingly framing VPNs less as privacy tools and more as ways to bypass online restrictions, especially as countries roll out mandatory age-verification systems and tighter internet controls. Even the European Union has recently hinted at tougher scrutiny around VPN usage tied to online safety initiatives.

Mozilla’s concerns also come shortly after the company announced plans to expand privacy protections inside Firefox itself, including built-in VPN functionality as part of a broader browser overhaul.

The bigger problem is that VPNs are slowly becoming “suspicious” by default

The awkward reality is that Mozilla might already be fighting a losing battle here. Around the world, governments are becoming increasingly aggressive about restricting encrypted internet access and anonymous browsing tools. Countries like China, Iran, Russia, Iraq, and Myanmar already heavily restrict or outright ban VPN usage in various forms, while others are actively discussing tighter controls.

Ironically, the more governments try to clamp down on VPNs, the more essential they become for journalists, activists, remote workers, businesses, and even regular users simply trying to protect their browsing activity on public networks. In fact, in a recent conversation with Russian business outlet RBC, Valery Fadeyev, head of Russia’s Presidential Council for Civil Society and Human Rights, also admitted that fully banning VPNs is “simply impossible”.

“It became clear fairly quickly that this is an extremely complex system and that banning or switching off VPNs altogether is impossible.” – Fadeyev

That’s what makes this entire debate feel so messy. VPNs are simultaneously being treated as cybersecurity necessities and internet loopholes, depending on who’s talking. And honestly, once privacy tools start being framed as inherently suspicious, it becomes very hard to convince regulators otherwise.

An arrest is made in the Morgan McSweeney stolen iPhone case, a guilty plea in the Beyonce stolen music case, and an AirTag helps recover a stolen Lamborghini, all in this week’s Apple Crime Blotter.

The latest in an occasional AppleInsider series, looking at the world of Apple-related crime.

Apple product thieves were caught after one activated stolen Apple Watches

On May 7, the Justice Department announced indictments of three people for their parts in the “brazen daytime robbery” in January. That robbery entailed the hijacking of a truck near a Long Island Apple Store, and the theft of $1.2 million of MacBooks, iPhones, iPads, Apple Watches, and accessories.

The New York Times offered some detail about how the suspects were caught.

Leads included fingerprints on paperwork, one of the accused thieves renting a storage unit in his own name, and another of them activating two stolen Apple Watches.

There has been an arrest in the highest-profile recent iPhone theft in Britain.

In October of 2025, a government-issued iPhone was stolen from Morgan McSweeney, who at the time was chief of staff for British Prime Minister Kier Starmer.

The loss of the iPhone meant that McSweeney could not produce messages between himself and Lord Peter Mandelson, the former British ambassador to the U.S., who was in hot water over his ties to Jeffrey Epstein. Mandelson was removed and later indicted, and McSweeney stepped down in February.

In late April, The BBC reported, a man was arrested for selling McSweeney’s stolen iPhone. The man is not believed to be responsible for the original theft.

Also, the phone itself has not been recovered.

Man pleads guilty to stealing MacBooks, Beyonce’s unreleased music

In the summer of 2025, a rental car belonging to a member of pop superstar Beyonce’s entourage was broken into in Atlanta. This led to the theft of hard drives and computers, including a MacBook Air, which contained the singer’s unreleased music.

An arrest was made in September, and just before a trial was set to begin, the man accused in the thefts pleaded guilty on May 12.

According to ABC 7, the 40-year-old defendant agreed to serve two years in prison followed by three more on probation. Before the plea was announced, prosecutors showed videos of the defendant approaching the vehicle and later driving it to an apartment complex.

The stolen items, per that report, included “two MacBook laptops, Apple headphones, luxury clothing and accessories,” and hard drives that investigators say contained unreleased Beyonce material.

Teens arrested for thefts of iPhone cases

A lot of thieves around the world, including in the U.K., steal iPhones. Two teenagers in that country were arrested in that country for stealing iPhone cases.

Eastern Daily Press reports the two teens were arrested in Attleborough, where officers say they were carrying 42 iPhone cases, worth 2,500 pounds, or about $3,382.

The cases, the reports said, were stolen from Apple Stores in Norwich and Cambridge.

Federal indictment for man accused of hacking into victims’ accounts on iCloud, other services

Federal prosecutors have announced the indictment of a Maryland man who they say accessed the private information of nearly 200 victims.

A 41-year-old employee of a Maryland medical system reportedly used “various cyber intrusion techniques” to access victims’ accounts with “online services such as Google Photos, iCloud Photos, Gmail, and Microsoft 365, and social media accounts.” The scheme, as announced by the Justice Department, lasted for eight years.

The man has been charged with two counts of unauthorized access to a protected computer and one count of aggravated identity theft.

AirTag helps in recovery of stolen Lamborghini, after chase

Police used an AirTag to recover a stolen 2021 Lamborghini Urus, valued at $300,000, in New Jersey in late April.

According to CBS New York, surveillance video caught thieves stealing the car from a custom auto body shop called MoeModz. However, the car’s owner had thought to place an AirTag inside the Lamborghini, which police were able to track.

This led to a chase that reached the Garden State Parkway, which ended when the car’s occupants got out and fled on foot. One of them, a 21-year-old, was charged with receiving stolen property and resisting arrest.

The Lamborghini suffered $15,000 in damage.

Couple follows AirPods to scrapyard to find stolen car

Another case of an owner using Apple technology to find a stolen car occurred in Milwaukee in early May.

TMJ 4 reported that a couple from that city had left their car on a street following a tire blowout. When they came back with a spare, the car was gone.

After calls to various towyards proved fruitless, the owner checked Find My iPhone and realized his AirPods had been left in the car.

Unfortunately, once they followed the signal, the car was in a scrapyard, “already crushed.” The Milwaukee Police Department is investigating the theft.

AirPods tracked after vehicle burglaries

In another case of AirPods being tracked to find stolen merchandise, two men were arrested after a series of car burglaries in Quad Cities, Iowa.

According to KWQC, there were more than 15 car break-ins between early March and early May, and after one, in which a credit card and AirPods were taken, police tracked the AirPods to an apartment building. There, they found the AirPods and other stolen items, leading to the arrests.

Two charged with series of Facebook Marketplace thefts

Two Miami men, aged 20 and 22, have been arrested and charged with a series of Facebook Marketplace thefts in which they’re accused of stealing iPhones, iPads, and MacBooks.

WSVN reports police say the two men arranged meetings to buy the products on Marketplace, and at the meetups, they would steal the items without paying.

One of the two faces charges of robbery by sudden snatching, strong-arm robbery, burglary of an occupied conveyance, and grand theft.

TV host in the Philippines gets stolen iPad back

Teddy Corpuz, a well-known TV host in the Phillippines, had his iPad stolen, among other items, in a break-in May. However, per GMA News Online, Corpuz announced on Facebook that he has recovered the iPad.

Among other stolen items were “cash, jewelry, [and] a charger.”