Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing

Published on May 17, 2026

The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts. [...]

Continue reading on website
Other news

NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE

May 17, 2026
A newly disclosed security flaw impacting NGINX Plus and NGINX Open has come under active exploitation in the wild, days after its public disclosure, according to VulnCheck.The vulnerability, tracked as CVE-2026-42945 (CVSS score: 9.2), is a heap buffer overflow in ngx_http_rewrite_module affecting NGINX versions 0.6.27 through 1.30.0. According to AI-native security company depthfirst, the

New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released

May 17, 2026
A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows systems.  [...]