The Rainmaker Report

My first story tracks a brutal trust failure inside one of the world’s most famous health research projects: data tied to all 500,000 UK Biobank volunteers was advertised for sale on Alibaba by sellers linked to research access abuse. The UK government said names and contact details were not included, but the whole selling point of de-identified health data is that it is not supposed to wind up on a Chinese marketplace like discount headphones. UK Biobank paused access, cut off the implicated in...

💥 GitHub Had an RCE Problem the Size of the Internet 💥

CVE-2026-3854, a critical GitHub flaw that let an authenticated user turn a normal `git push` into remote code execution on backend infrastructure. Wiz said the issue could expose millions of public and private repositories on affected GitHub.com storage nodes, while GitHub Enterprise Server instances faced full server compromise if left unpatched. So yes, one semicolon and a bad design assumption almost turned the world’s code locker into a...

Yeah...I know the audio sounds terrible.

I'll figure it out and it'll be better tomorrow.

-AT

Basic-Fit, Europe’s largest gym chain, disclosed a breach affecting roughly 1 million members across six countries after attackers accessed a system used to record club visits. Stolen data includes names, contact details, dates of birth, and bank account information, which makes this a whole lot worse than a marketing email leak. Apparently the hardest part of going to the gym in 2026 is not getting ...

💋 70,000 NSFW AI Prompts Just Got Tied Back to Real People 💋

A breach involving MyLovely.AI exposed data on more than 100,000 users, including explicit prompts, generated content links, account metadata, and roughly 70,000 prompts directly tied to unique user IDs. That matters because the leak does not just reveal email addresses — it deanonymizes deeply personal sexual content and creates obvious openings for sextortion, doxxing, and harassment. The lesson is brutal and simple: people keep tre...

🤖 Cybercriminals Are Using Emojis to Hide in Plain Sight 🤖

Threat actors are increasingly using emojis as a functional layer of communication across Telegram, Discord, dark web forums, and cybercrime marketplaces to flag tools, stolen data, payouts, urgency, and targets while dodging simplistic keyword-based monitoring. Researchers say the symbols are not decorative fluff — they help criminals compress meaning, build reputation, speed up coordination, and add a second layer of obfuscation that ...

Daily cybersecurity threat intelligence briefing for 2026-04-09 covering Emoji's, LATAM mobile fraud, and Microsoft developer security issues.

Microsoft released security updates fixing 77 vulnerabilities across Windows and related software in its March 2026 Patch Tuesday, including critical remote code execution flaws in Microsoft Office that can be triggered simply by viewing a malicious email in the Preview Pane. Two publicly disclosed zero-days were patched: CVE-2026-21262, a privilege escalation bug in SQL Server that allows network-based elevation to sysadmin, and CVE-2026-26127, a .NET denial-of-service vulnerability. Over half ...

🐻 Russia Stole Microsoft Tokens from 18,000 Hacked Routers 🐻

Russian military intelligence unit APT28 (Forest Blizzard) compromised over 18,000 Internet routers to conduct a massive DNS hijacking campaign that stole Microsoft Office authentication tokens from 200+ organizations and 5,000 consumer devices. The state-sponsored hackers exploited vulnerabilities in older TP-Link and MikroTik routers to redirect DNS traffic through attacker-controlled servers, intercepting OAuth tokens after users c...

🚨 AI-Powered GitHub Attack Steals Secrets from Open Source Projects 🚨

A sophisticated AI-assisted supply chain attack called "PRT-scan" has targeted hundreds of GitHub repositories using fake pull requests to exfiltrate developer credentials and secrets. The campaign, which began on March 11, 2026, leverages automated AI to rapidly identify and exploit GitHub Actions misconfigurations across open source projects. Threat actors created multiple disposable accounts to submit over 256 malicious pu...

Germany Finally IDs the Ghost Behind REvil & GandCrab Ransomware

Germany just unmasked one of cybercrime's biggest ghosts—Daniil Shchukin, the 31-year-old Russian who ran both GandCrab and REvil ransomware operations. From $2 billion in extortion to the Kaseya attack that hit 1,500+ businesses, this is the story of how they finally caught the hacker known as "UNKN."

Sources:

- https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/

- https://www.bka.d...