The Rainmaker Report

🚨 AI-Powered GitHub Attack Steals Secrets from Open Source Projects 🚨 A sophisticated AI-assisted supply chain attack called "PRT-scan" has targeted hundreds of GitHub repositories using fake pull requests to exfiltrate developer credentials and secrets. The campaign, which began on March 11, 2026, leverages automated AI to rapidly identify and exploit GitHub Actions misconfigurations across ope...

Germany Finally IDs the Ghost Behind REvil & GandCrab Ransomware Germany just unmasked one of cybercrime's biggest ghosts—Daniil Shchukin, the 31-year-old Russian who ran both GandCrab and REvil ransomware operations. From $2 billion in extortion to the Kaseya attack that hit 1,500+ businesses, this is the story of how they finally caught the hacker known as "UNKN." Sources: - https://krebsonsecur...

🔐 Google's AI Agent Permissions Are a Ticking Time Bomb 💣 Palo Alto Networks Unit 42 researchers discovered that Google's Vertex AI gives AI agents dangerously excessive default permissions that allow attackers to break out of the AI environment, steal customer data from Google Cloud Projects, and even access Google's internal infrastructure. The vulnerability stems from the overprivileged Per-P...

💼🕵️ Professional Networks Under Attack: PXA Stealer Campaign 🕵️💼 A Vietnam-linked hacking group is targeting LinkedIn users with PXA Stealer malware, designed to harvest saved passwords, browser cookies, and two-factor authentication codes from professionals on the platform. Once credentials are stolen, hackers can impersonate victims to phish coworkers, spread malware through DMs, and run fake...

🍣 Crunchyroll Confirmed 6.8M Users Were Breached. It Wasn't Even Their Fault. 😭 ShinyHunters, the group behind breaches at AT&T, Ticketmaster, and Santander, stole data on 6.8 million Crunchyroll users via a supply chain attack through Telus Digital. A Telus employee ran malware on their work laptop, giving the attacker access to Crunchyroll's environment. Stolen data includes names, emails, pas...

🍥 Crunchyroll Got Hacked — Your Email, Password & Credit Card May Be Gone A threat actor breached Crunchyroll on March 12, 2026 through a compromised employee at TELUS, their outsourcing partner — who had malware on his machine that gave the attacker access to Crunchyroll's environment. Roughly 100GB of customer analytics data was exfiltrated before the breach was stopped, potentially including e...

🎵 This Musician Made $10 Million Streaming His Own Songs — With Fake AI Listeners. He's Going to Prison. Michael Smith, a North Carolina musician, pleaded guilty to wire fraud conspiracy after using AI-generated music and AI bots to fake billions of streams on Spotify, Apple Music, and Amazon Music — pocketing over $10 million in royalty payments that should have gone to real artists. He created...

🏥 Ransomware Gang Knocked Out Mississippi's Only Children's Hospital — For 9 Days The Medusa ransomware gang, believed to operate out of Russia, has claimed responsibility for a devastating February cyberattack on the University of Mississippi Medical Center — the state's only children's hospital, Level I trauma center, and organ transplant facility. The hospital went completely dark for nine day...

🎣 Hackers Are Posing as PayPal & Amazon Support — And Stealing Your MFA Codes in Real Time Researchers discovered attackers are hijacking LiveChat — the same support tool used by thousands of legitimate companies — to impersonate PayPal and Amazon agents in real time. Victims are lured via phishing emails, connected to a fake live chat, coaxed into sharing credit card numbers and MFA codes, and t...

🤖 Bing AI Promotes Fake GitHub Repos with Malware 🤖 Microsoft Bing's AI search feature promoted fake OpenClaw GitHub repositories that deployed infostealers and proxy malware, marking the first major case of AI search engines serving malicious content. • BleepingComputer: https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/ • Th...

https://www.fox5atlanta.com/video/fmc-j4vfei7ygyzc56l6 I was interviewed by Fox 5 Atlanta about Instagram's new safety update that notifies parents when their teen repeatedly searches for suicide or self-harm-related terms. While it sounds like a step forward from Meta, is it really enough? We break down what this feature actually does, what it doesn't, and whether this marks a genuine shift in ho...

🤖 Hackers Weaponize Claude AI - Mexico Government Hacked 🤖 Threat actors weaponized Anthropic's Claude Code AI assistant to breach the Mexican government's systems and steal over 150GB of sensitive data, including civil registry files, tax records, and voter data. Roughly 195 million identities were exposed. This represents the first confirmed use of a commercial AI coding tool in a government-l...

👮 Europol Crackdown on The Com Hackers - 30 Arrests 👮 Europol's Project Compass led to 30 arrests of The Com cybercrime collective members across 28 countries. The group targets children for extortion and CSAM production, linked to major ransomware attacks and organized into subgroups including 764. • https://www.bleepingcomputer.com/news/security/police-crackdown-on-the-com-cybercrime-gang-lead...

Ex-L3Harris Executive Sentenced for Selling Zero-Days to Russian Broker Peter Williams, former general manager of L3Harris's Trenchant cybersecurity unit, was sentenced to 87 months in prison for stealing and selling 8 zero-day exploits to Russian broker Operation Zero for $1.3M in cryptocurrency. The theft caused $35M in losses and could enable access to millions of devices worldwide. • https://w...

🎰 Wynn Resorts Las Vegas Hit by Cybersecurity Breach 🎰 What happens in Vegas... apparently gets stolen by ShinyHunters. Wynn Resorts, one of Las Vegas's biggest casino operators, just confirmed they got hacked. And when I say hacked, I mean eight hundred thousand employee records—complete with Social Security numbers—stolen by ransomware criminals who are now demanding a million and a half dolla...

🚨 Conduent Breach Now Largest in US History - 25+ Million Affected Conduent Business Services confirmed one of the largest data breaches in U.S. history affecting 25+ million individuals. Safepay ransomware group stole 8TB of data including SSNs, medical histories, and health insurance details between October 2024 and January 2025. Sources: • https://cybersecuritynews.com/conduent-data-breach/ •...

🚨 Texas Sues TP-Link Over Chinese Hacking Risks 🚨 Texas sued TP-Link Systems alleging the company deceptively marketed routers as secure while firmware vulnerabilities enabled Chinese state-backed hackers to compromise American users' devices and networks. Sources: • https://www.bleepingcomputer.com/news/security/texas-sues-tp-link-over-chinese-hacking-risks-user-deception/ • https://www.texasat...

🔴 Google Patches First Chrome Zero-Day of 2026 — Actively Exploited 🔴 Google released emergency updates on February 16, 2026 to patch CVE-2026-2441, a high-severity use-after-free vulnerability in Chrome with a CVSS score of 8.8. The flaw is being actively exploited in the wild, allowing remote attackers to potentially execute code by getting victims to visit a crafted webpage. This is Chrome's...

🦀Infostealer Steals OpenClaw AI Agent Secrets🦀 Information-stealing malware has been observed for the first time specifically targeting OpenClaw, a popular agentic AI assistant framework, stealing API keys, authentication tokens, and cloud credentials stored in its configuration files. This attack vector is particularly dangerous because compromised AI agent credentials can give attackers access...

📬 Hackers Are Literally Mailing You Fake Letters 📬 Threat actors are sending physical letters through postal mail pretending to be from Trezor and Ledger, manufacturers of cryptocurrency hardware wallets. The letters use official-looking branding and urgent language to trick recipients into revealing their wallet recovery phrases on fake websites. The scam represents a sophisticated blend of phy...

🤖 Hackers Weaponize Google's Gemini AI in Multi-Stage Attacks 🤖 Google Threat Intelligence Group published a report warning about AI model extraction and distillation attacks where threat actors abuse legitimate API access to systematically probe AI models. Attackers are using Gemini AI across all stages of cyber attacks, from reconnaissance to payload delivery. Sources: • https://www.bleepingco...

📝 Windows 11 NOTEPAD RCE ZERO-DAY Executes Files Silently 📝 Microsoft patched a remote code execution vulnerability in Windows 11 Notepad that allowed attackers to execute local or remote programs through specially crafted Markdown links without triggering Windows security warnings. Users could be tricked into clicking malicious links in seemingly harmless text files. Sources: • https://www.blee...

🚨 Microsoft Patches 6 Actively Exploited Zero-Days 🚨 Microsoft's February 2026 Patch Tuesday fixes dozens of Windows and Office bugs, including six zero-day vulnerabilities actively exploited in the wild. Security teams are urged to patch quickly, especially for flaws tied to SmartScreen bypass and privilege escalation. Sources: • https://www.bleepingcomputer.com/news/microsoft/microsoft-februar...

🏢 Conduent Breach Balloons to Millions 🏢 The data breach at government technology giant Conduent has expanded dramatically, now affecting millions more Americans. The Safeway ransomware group claims responsibility for stealing over 8 terabytes of data containing personal and health information. Conduent handles data for more than 100 million people across America, making this one of the largest...

⚠️ BeyondTrust Critical RCE Flaw Patched ⚠️ BeyondTrust patched a critical pre-authentication remote code execution vulnerability (CVE-2026-1731) in Remote Support and PRA products. Attackers could run OS commands via crafted requests without authentication. Approximately 11,000 exposed instances were found online. Security patches have been released for all affected versions. Sources: • https://t...