The Rainmaker Report

GitHub TeamPCP Breach Investigation GitHub is investigating a claimed breach by threat actor TeamPCP affecting approximately 4,000 internal repositories. The attacker claims to have accessed sensitive GitHub infrastructure, raising concerns about the security of the platform's internal development assets. This incident highlights risks to major software development platforms and their internal cod...

STORY 1: Double Canvas Breach Acknowledged by ShinyHunters Instructure's Canvas learning management platform suffered a confirmed data breach after threat actor ShinyHunters gained unauthorized access. The group has set a new pay-or-leak deadline, pressuring the company to negotiate ransom terms. Double Canvas users and institutions face potential exposure of sensitive educational data. Sources: •...

🚨 British hacker just pleaded guilty to $10M+ crypto heist 🚨 Tylerb, a 24-year-old member of Scattered Spider, admitted to wire fraud and identity theft in US federal court. Here's the wild part: he didn't use fancy hacking tools. Instead, he sent fake IT texts (smishing), stole employee passwords, and his crew hit over a dozen major tech companies. Scattered Spider's whole playbook is social en...

🚨 OpenAI Got Hit in the TanStack Supply Chain Attack 🚨 Two OpenAI employee devices were compromised when attackers poisoned hundreds of npm and PyPI packages. Here's what went down. TanStack is everywhere in JavaScript and Python projects. Attackers injected malicious code into the supply chain, and anyone who pulled those packages during the compromise window got exposed. OpenAI immediately rot...

👀 LinkedIn Was Quietly Inspecting Your Browser Like a Nosy Cop 👀 "BrowserGate," a report alleging LinkedIn quietly scanned users’ browsers for thousands of installed extensions and attached a hardware-style fingerprint to session activity without meaningful disclosure. LinkedIn says the probing is a security measure aimed at scraping tools, but the reporting and independent testing show the beha...

My first story tracks a brutal trust failure inside one of the world’s most famous health research projects: data tied to all 500,000 UK Biobank volunteers was advertised for sale on Alibaba by sellers linked to research access abuse. The UK government said names and contact details were not included, but the whole selling point of de-identified health data is that it is not supposed to wind up on...

💥 GitHub Had an RCE Problem the Size of the Internet 💥 CVE-2026-3854, a critical GitHub flaw that let an authenticated user turn a normal `git push` into remote code execution on backend infrastructure. Wiz said the issue could expose millions of public and private repositories on affected GitHub.com storage nodes, while GitHub Enterprise Server instances faced full server compromise if left unp...

Yeah...I know the audio sounds terrible. I'll figure it out and it'll be better tomorrow. -AT Basic-Fit, Europe’s largest gym chain, disclosed a breach affecting roughly 1 million members across six countries after attackers accessed a system used to record club visits. Stolen data includes names, contact details, dates of birth, and bank account information, which makes this a whole lot worse tha...

💋 70,000 NSFW AI Prompts Just Got Tied Back to Real People 💋 A breach involving MyLovely. AI exposed data on more than 100,000 users, including explicit prompts, generated content links, account metadata, and roughly 70,000 prompts directly tied to unique user IDs. That matters because the leak does not just reveal email addresses — it deanonymizes deeply personal sexual content and creates obvi...

🤖 Cybercriminals Are Using Emojis to Hide in Plain Sight 🤖 Threat actors are increasingly using emojis as a functional layer of communication across Telegram, Discord, dark web forums, and cybercrime marketplaces to flag tools, stolen data, payouts, urgency, and targets while dodging simplistic keyword-based monitoring. Researchers say the symbols are not decorative fluff — they help criminals c...

Microsoft released security updates fixing 77 vulnerabilities across Windows and related software in its March 2026 Patch Tuesday, including critical remote code execution flaws in Microsoft Office that can be triggered simply by viewing a malicious email in the Preview Pane. Two publicly disclosed zero-days were patched: CVE-2026-21262, a privilege escalation bug in SQL Server that allows network...

🐻 Russia Stole Microsoft Tokens from 18,000 Hacked Routers 🐻 Russian military intelligence unit APT28 (Forest Blizzard) compromised over 18,000 Internet routers to conduct a massive DNS hijacking campaign that stole Microsoft Office authentication tokens from 200+ organizations and 5,000 consumer devices. The state-sponsored hackers exploited vulnerabilities in older TP-Link and MikroTik routers...

🚨 AI-Powered GitHub Attack Steals Secrets from Open Source Projects 🚨 A sophisticated AI-assisted supply chain attack called "PRT-scan" has targeted hundreds of GitHub repositories using fake pull requests to exfiltrate developer credentials and secrets. The campaign, which began on March 11, 2026, leverages automated AI to rapidly identify and exploit GitHub Actions misconfigurations across ope...

Germany Finally IDs the Ghost Behind REvil & GandCrab Ransomware Germany just unmasked one of cybercrime's biggest ghosts—Daniil Shchukin, the 31-year-old Russian who ran both GandCrab and REvil ransomware operations. From $2 billion in extortion to the Kaseya attack that hit 1,500+ businesses, this is the story of how they finally caught the hacker known as "UNKN." Sources: - https://krebsonsecur...

🔐 Google's AI Agent Permissions Are a Ticking Time Bomb 💣 Palo Alto Networks Unit 42 researchers discovered that Google's Vertex AI gives AI agents dangerously excessive default permissions that allow attackers to break out of the AI environment, steal customer data from Google Cloud Projects, and even access Google's internal infrastructure. The vulnerability stems from the overprivileged Per-P...

💼🕵️ Professional Networks Under Attack: PXA Stealer Campaign 🕵️💼 A Vietnam-linked hacking group is targeting LinkedIn users with PXA Stealer malware, designed to harvest saved passwords, browser cookies, and two-factor authentication codes from professionals on the platform. Once credentials are stolen, hackers can impersonate victims to phish coworkers, spread malware through DMs, and run fake...

🍣 Crunchyroll Confirmed 6.8M Users Were Breached. It Wasn't Even Their Fault. 😭 ShinyHunters, the group behind breaches at AT&T, Ticketmaster, and Santander, stole data on 6.8 million Crunchyroll users via a supply chain attack through Telus Digital. A Telus employee ran malware on their work laptop, giving the attacker access to Crunchyroll's environment. Stolen data includes names, emails, pas...

🍥 Crunchyroll Got Hacked — Your Email, Password & Credit Card May Be Gone A threat actor breached Crunchyroll on March 12, 2026 through a compromised employee at TELUS, their outsourcing partner — who had malware on his machine that gave the attacker access to Crunchyroll's environment. Roughly 100GB of customer analytics data was exfiltrated before the breach was stopped, potentially including e...

🎵 This Musician Made $10 Million Streaming His Own Songs — With Fake AI Listeners. He's Going to Prison. Michael Smith, a North Carolina musician, pleaded guilty to wire fraud conspiracy after using AI-generated music and AI bots to fake billions of streams on Spotify, Apple Music, and Amazon Music — pocketing over $10 million in royalty payments that should have gone to real artists. He created...

🏥 Ransomware Gang Knocked Out Mississippi's Only Children's Hospital — For 9 Days The Medusa ransomware gang, believed to operate out of Russia, has claimed responsibility for a devastating February cyberattack on the University of Mississippi Medical Center — the state's only children's hospital, Level I trauma center, and organ transplant facility. The hospital went completely dark for nine day...

🎣 Hackers Are Posing as PayPal & Amazon Support — And Stealing Your MFA Codes in Real Time Researchers discovered attackers are hijacking LiveChat — the same support tool used by thousands of legitimate companies — to impersonate PayPal and Amazon agents in real time. Victims are lured via phishing emails, connected to a fake live chat, coaxed into sharing credit card numbers and MFA codes, and t...

🤖 Bing AI Promotes Fake GitHub Repos with Malware 🤖 Microsoft Bing's AI search feature promoted fake OpenClaw GitHub repositories that deployed infostealers and proxy malware, marking the first major case of AI search engines serving malicious content. • BleepingComputer: https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/ • Th...

https://www.fox5atlanta.com/video/fmc-j4vfei7ygyzc56l6 I was interviewed by Fox 5 Atlanta about Instagram's new safety update that notifies parents when their teen repeatedly searches for suicide or self-harm-related terms. While it sounds like a step forward from Meta, is it really enough? We break down what this feature actually does, what it doesn't, and whether this marks a genuine shift in ho...

🤖 Hackers Weaponize Claude AI - Mexico Government Hacked 🤖 Threat actors weaponized Anthropic's Claude Code AI assistant to breach the Mexican government's systems and steal over 150GB of sensitive data, including civil registry files, tax records, and voter data. Roughly 195 million identities were exposed. This represents the first confirmed use of a commercial AI coding tool in a government-l...

👮 Europol Crackdown on The Com Hackers - 30 Arrests 👮 Europol's Project Compass led to 30 arrests of The Com cybercrime collective members across 28 countries. The group targets children for extortion and CSAM production, linked to major ransomware attacks and organized into subgroups including 764. • https://www.bleepingcomputer.com/news/security/police-crackdown-on-the-com-cybercrime-gang-lead...