Cybercrime duo accused of picking $2.5M from Apple's orchard

Two researchers are accused of compromising a third‑party customer support contractor (via a password‑reset tool and credential theft), using VPN/RDP access and Jamf‑driven remote machines with reverse SSH tunnels to reach a major tech company's backend (likely Apple). They allegedly used App Store Connect/Toolbox to modify orders and redeem or obtain over $2.6M in gift cards and hardware, shipping items through transshipment companies to conceal identities; one defendant has also been credited separately for legitimate vulnerability research (CVE reports).