The Rainmaker Report

Story 1: SCMBanker Malware Uses ClickFix Lures SCMBanker, a Mexican banking trojan, is now being distributed through ClickFix social engineering lures. The malware targets financial credentials and uses advanced evasion techniques to avoid detection. Researchers at Elastic Security Labs have detailed the infection chain and its focus on Latin American banking customers. • https://thehackernews.com...

## 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges A 19-year-old suspected member of the Scattered Spider cybercriminal group has been extradited to the United States to face federal hacking charges. The individual is allegedly linked to a series of high-profile social engineering attacks and data thefts targeting major tech companies. Law enforcement coordinated with...

**Story 1: Klue Breach Exposes Multiple Cybersecurity Firms** A data breach at Klue, a threat intelligence platform, has led to the exposure of sensitive information belonging to several cybersecurity companies. The incident, which occurred in late June, compromised internal data used by security firms for threat detection and response. Affected organizations are now assessing the scope of the lea...

In this video, we cover three major cybersecurity stories from June 25, 2026. **Story 1: Madison Square Garden Breach** Hackers breached Madison Square Garden's systems, compromising sensitive data. The attack involved sophisticated social engineering and exploited vulnerabilities in third-party services. Details on the attack vector and impact are still emerging. • https://databreaches.net/2026/0...

In this week's cybersecurity roundup, we cover three major incidents: the conviction of Scattered Spider members, a supply chain breach at LastPass, and a massive credential theft campaign targeting Fortinet firewalls. --- **Story 1: Scattered Spider Members Plead Guilty in TfL Cyberattack** Two individuals linked to the Scattered Spider hacking group pleaded guilty for their roles in a cyberattac...

**Microsoft June 2026 Patch Tuesday Fixes Over 200 Flaws Including Three Zero-Days** Microsoft released its June 2026 Patch Tuesday update, addressing more than 200 vulnerabilities across its product line. Among the fixes are three zero-day vulnerabilities actively exploited in the wild. The update covers critical remote code execution flaws in Windows, Office, and Exchange Server, along with nume...

Story 1: NSO Group Spyware Resurfaces on WhatsApp Meta has filed a contempt complaint against NSO Group, alleging that the spyware vendor violated a court order by deploying new zero-click spyware attacks on WhatsApp in June 2026. The attacks targeted journalists and civil society members, using a previously unseen payload that bypassed recent WhatsApp security patches. Meta states the exploitatio...

**Story 1: European Authorities Dismantle Illegal Streaming Networks** European law enforcement agencies, led by Europol, executed Operation Kratos II, arresting 29 individuals and dismantling nine organized crime groups involved in large-scale illegal streaming operations. The crackdown targeted networks that distributed pirated content, causing significant revenue losses to legitimate media prov...

Story 1: BlackCat ransomware operators maintain regular business hours, according to an analysis of 24 months of leak site posts. The data shows a clear pattern of activity during standard workdays and hours, suggesting organized criminal operations rather than opportunistic attacks. • https://securityaffairs.com/192969/cyber-crime/ransomware-operators-keep-business-hours-the-data-proves-it.html •...

This week's cybersecurity roundup covers three major incidents: a novel social engineering attack using Meta's AI support bot to steal Instagram accounts, a massive data breach at the Atlas Menu cheat service for Grand Theft Auto V and Counter-Strike 2, and a brute-force attack that forced Dashlane to suspend customer accounts. **Story 1: Hackers Used Meta's AI Support Bot to Seize Instagram Accou...

## Story 1: Carnival Corporation Confirms Breach Impacting Nearly 6 Million Customers Carnival Cruise Line has confirmed a data breach affecting close to 6 million customers, with the ShinyHunters extortion group claiming responsibility. Stolen records reportedly include names, contact details, dates of birth, and loyalty program information tied to Carnival, Princess, and Holland America bookings...

In this episode, we cover three major cybersecurity stories shaping the week: Apple's massive App Store enforcement actions and a critical Cisco patch, the takedown of the Kimwolf DDoS botnet operator, and Anthropic's Glasswing AI uncovering thousands of vulnerabilities including CVE-2026-5194. === Story 1: Apple Rejects 2M Apps, Cisco Patches Critical Secure Workload Flaw, Ocean Launches Email Se...

Story 1: Shinyhunters Canvas Data Breach The threat actor group Shinyhunters claimed to have stolen student data from Canvas, a widely-used learning management system, but security researchers and congressional investigators express skepticism about whether the stolen information was actually deleted as promised. The breach has drawn attention from Congress and triggered inquiries into Instructure...

GitHub TeamPCP Breach Investigation GitHub is investigating a claimed breach by threat actor TeamPCP affecting approximately 4,000 internal repositories. The attacker claims to have accessed sensitive GitHub infrastructure, raising concerns about the security of the platform's internal development assets. This incident highlights risks to major software development platforms and their internal cod...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data. Sources: •...

🚨 British hacker just pleaded guilty to $10M+ crypto heist 🚨 Tylerb, a 24-year-old member of Scattered Spider, admitted to wire fraud and identity theft in US federal court. Here's the wild part: he didn't use fancy hacking tools. Instead, he sent fake IT texts (smishing), stole employee passwords, and his crew hit over a dozen major tech companies. Scattered Spider's whole playbook is social en...

🚨 OpenAI Got Hit in the TanStack Supply Chain Attack 🚨 Two OpenAI employee devices were compromised when attackers poisoned hundreds of npm and PyPI packages. Here's what went down. TanStack is everywhere in JavaScript and Python projects. Attackers injected malicious code into the supply chain, and anyone who pulled those packages during the compromise window got exposed. OpenAI immediately rot...

👀 LinkedIn Was Quietly Inspecting Your Browser Like a Nosy Cop 👀 "BrowserGate," a report alleging LinkedIn quietly scanned users’ browsers for thousands of installed extensions and attached a hardware-style fingerprint to session activity without meaningful disclosure. LinkedIn says the probing is a security measure aimed at scraping tools, but the reporting and independent testing show the beha...

My first story tracks a brutal trust failure inside one of the world’s most famous health research projects: data tied to all 500,000 UK Biobank volunteers was advertised for sale on Alibaba by sellers linked to research access abuse. The UK government said names and contact details were not included, but the whole selling point of de-identified health data is that it is not supposed to wind up on...

💥 GitHub Had an RCE Problem the Size of the Internet 💥 CVE-2026-3854, a critical GitHub flaw that let an authenticated user turn a normal `git push` into remote code execution on backend infrastructure. Wiz said the issue could expose millions of public and private repositories on affected GitHub.com storage nodes, while GitHub Enterprise Server instances faced full server compromise if left unp...

Yeah...I know the audio sounds terrible. I'll figure it out and it'll be better tomorrow. -AT Basic-Fit, Europe’s largest gym chain, disclosed a breach affecting roughly 1 million members across six countries after attackers accessed a system used to record club visits. Stolen data includes names, contact details, dates of birth, and bank account information, which makes this a whole lot worse tha...

💋 70,000 NSFW AI Prompts Just Got Tied Back to Real People 💋 A breach involving MyLovely. AI exposed data on more than 100,000 users, including explicit prompts, generated content links, account metadata, and roughly 70,000 prompts directly tied to unique user IDs. That matters because the leak does not just reveal email addresses — it deanonymizes deeply personal sexual content and creates obvi...

🤖 Cybercriminals Are Using Emojis to Hide in Plain Sight 🤖 Threat actors are increasingly using emojis as a functional layer of communication across Telegram, Discord, dark web forums, and cybercrime marketplaces to flag tools, stolen data, payouts, urgency, and targets while dodging simplistic keyword-based monitoring. Researchers say the symbols are not decorative fluff — they help criminals c...

Microsoft released security updates fixing 77 vulnerabilities across Windows and related software in its March 2026 Patch Tuesday, including critical remote code execution flaws in Microsoft Office that can be triggered simply by viewing a malicious email in the Preview Pane. Two publicly disclosed zero-days were patched: CVE-2026-21262, a privilege escalation bug in SQL Server that allows network...

🐻 Russia Stole Microsoft Tokens from 18,000 Hacked Routers 🐻 Russian military intelligence unit APT28 (Forest Blizzard) compromised over 18,000 Internet routers to conduct a massive DNS hijacking campaign that stole Microsoft Office authentication tokens from 200+ organizations and 5,000 consumer devices. The state-sponsored hackers exploited vulnerabilities in older TP-Link and MikroTik routers...