The Rainmaker Report

📦 That WinRAR "Free Trial" You Never Paid For? Hackers Are Exploiting It Right Now 🚨

A WinRAR vulnerability patched last July (CVE-2025-8088) is still being actively exploited by Russian APTs, Chinese threat actors, and cybercrime gangs six months later. The path traversal flaw lets attackers slip malicious files into your system when you extract see...

💔 10M Dating App Users Exposed in Match Group Breach 💔

ShinyHunters cybercrime group claims to have stolen over 10 million records from Match Group (NASDAQ: MTCH), owner of Tinder, Hinge, Match.com, and OkCupid. The alleged breach, posted January 28, 2026, includes user behavioral data from Appsflyer analytics (swipes, matches, sessions, geo-locations), hundreds of internal corporate documents, and highly sensitive personal information including romantic preferences. The 1.76GB compressed dump ...

🤖 Hundreds of Clawdbot Servers Exposed with API Keys & Private Chats 🔓

Security researchers have discovered hundreds of publicly exposed Clawdbot control servers containing API keys, private messages, and OAuth credentials. The viral AI assistant, which went mainstream over the weekend, has critical authentication vulnerabilities allowing unauthorized access to users' complete chat histories, financial accounts, and system commands. Misconfigured servers could enable credential theft and remote...

🇬🇧 UK Lords Vote to Ban VPNs for Kids 🇬🇧

The UK House of Lords voted 207 to 159 to ban VPNs for anyone under 18, claiming it will prevent children from bypassing age verification on social media and adult content. The amendment would require VPN providers to implement age verification, likely through government IDs or facial scans. Privacy advocates are calling it surveillance infrastructure disguised as child protection, and the measure now heads to the House of Commons.

- https://hansard.par...

🎵⚖️ Spotify Pulled Off a SECRET LAWSUIT to Stop Pirates Who Stole 300TB of Music 🎵⚖️

Shadow library Anna's Archive, which scraped nearly 300 terabytes of Spotify's music catalog in December 2025, lost its primary .org domain after Spotify and major record labels filed a sealed lawsuit and secured a court order before the site even knew it was being sued. A federal judge granted a preliminary injunction on January 16, 2026, ordering domain registries and internet infrastructure providers worldwi...

🤖 NVIDIA & Meta Caught Pirating 500TB to Train AI Models 🏴‍☠️

Billion-dollar tech companies got caught red-handed downloading hundreds of terabytes of pirated books to train their AI. NVIDIA literally asked a piracy site for 500TB of stolen content, got WARNED it was illegal, and said "send it anyway." Meanwhile Zuckerberg's playing dumb even though internal messages show he approved it…classic corporate villain energy.

Sources:

- https://torrentfreak.com/nvidia-contacted-annas-archive-to-sec...

🚨 LastPass Phishing Alert: Fake Backup Emails Target Your Master Password 🔐

LastPass users are being targeted by a phishing campaign that started January 19th, with fake emails claiming urgent maintenance requires vault backups within 24 hours. The emails redirect victims to malicious sites attempting to steal master passwords. The campaign was deliberately launched during the MLK holiday weekend when security teams are understaffed.

- https://www.securityweek.com/lastpass-users-targeted-with-...

🚨 ESA Breached Twice in 2 Weeks: Space Mission Data Stolen 🚀

- https://cisoseries.com/cybersecurity-news-esa-confirms-new-data-heist-ni8mare-lets-hackers-hijack-n8n-servers-taiwan-blames-cyber-army-for-intrusion-attempts/

- https://www.theregister.com/2026/01/07/european_space_agency_breach_criminal_probe/

- https://www.space.com/space-exploration/esa-email-credentials-on-dark-web

- https://www.securityweek.com/european-space-agency-confirms-breach-after-hacker-offers-to-sell-data

- https://www....

🚨 CyberArk Labs Hacks the Hackers with XSS on StealC Credential Stealing Malware. 🚨

• https://www.cyberark.com/resources/threat-research-blog/uno-reverse-card-stealing-cookies-from-cookie-stealers

• https://www.bleepingcomputer.com/news/security/stealc-hackers-hacked-as-researchers-hijack-malware-control-panels/

• https://www.bleepingcomputer.com/news/security/stealc-hackers-hacked-as-researchers-hijack-malware-control-panels/

• https://bazaar.abuse.ch/browse/tag/Stealc-v2/

• https://www.zscale...

🇨🇳🛡️ China orders firms to drop US and Israeli cybersecurity software, major vendors hit 🛡️🇨🇳

China has told domestic companies to stop using cybersecurity products from a list of US and Israeli firms, citing national security concerns. The move could force rapid tool replacements inside networks where security platforms have deep visibility into traffic and identity.

• https://www.reuters.com/world/china/beijing-tells-chinese-firms-stop-using-us-israeli-cybersecurity-software-sources-2026-01-1...