The Rainmaker Report

Daily cybersecurity threat intelligence briefing for 2026-04-06. Today's stories: Germany doxes UNKN (REvil/GandCrab ransomware boss), Qilin Warlock use BYOVD to disable 300+ EDR tools, and the dangers of third-party QR code scanners.

🔐 Google's AI Agent Permissions Are a Ticking Time Bomb 💣

Palo Alto Networks Unit 42 researchers discovered that Google's Vertex AI gives AI agents dangerously excessive default permissions that allow attackers to break out of the AI environment, steal customer data from Google Cloud Projects, and even access Google's internal infrastructure. The vulnerability stems from the overprivileged Per-Project, Per-Product Service Agent (P4SA) that's automatically assigned to every AI agent deployed on t...

💼🕵️ Professional Networks Under Attack: PXA Stealer Campaign 🕵️💼

A Vietnam-linked hacking group is targeting LinkedIn users with PXA Stealer malware, designed to harvest saved passwords, browser cookies, and two-factor authentication codes from professionals on the platform. Once credentials are stolen, hackers can impersonate victims to phish coworkers, spread malware through DMs, and run fake job offer scams. Protect yourself now by enabling authenticator-based 2FA, avoiding unsolicited links...

Daily cybersecurity threat intelligence briefing for 2026-03-31. Today's stories: LinkedIn under attack by Vietnam APT PXA Stealer, Axios npm supply chain attack, and TeamPCP AWS lateral movement.

🍣 Crunchyroll Confirmed 6.8M Users Were Breached. It Wasn't Even Their Fault. 😭

ShinyHunters, the group behind breaches at AT&T, Ticketmaster, and Santander, stole data on 6.8 million Crunchyroll users via a supply chain attack through Telus Digital. A Telus employee ran malware on their work laptop, giving the attacker access to Crunchyroll's environment. Stolen data includes names, emails, passwords, support records, and potentially payment details. ShinyHunters has a track record of selling ...

🍥 Crunchyroll Got Hacked — Your Email, Password & Credit Card May Be Gone

A threat actor breached Crunchyroll on March 12, 2026 through a compromised employee at TELUS, their outsourcing partner — who had malware on his machine that gave the attacker access to Crunchyroll's environment. Roughly 100GB of customer analytics data was exfiltrated before the breach was stopped, potentially including emails, passwords, and credit card information. Crunchyroll took 24 hours to detect the breach. As of...

🎵 This Musician Made $10 Million Streaming His Own Songs — With Fake AI Listeners. He's Going to Prison.

Michael Smith, a North Carolina musician, pleaded guilty to wire fraud conspiracy after using AI-generated music and AI bots to fake billions of streams on Spotify, Apple Music, and Amazon Music — pocketing over $10 million in royalty payments that should have gone to real artists. He created thousands of fake streaming accounts, generated AI songs to fill them, and had bots stream them arou...

🏥 Ransomware Gang Knocked Out Mississippi's Only Children's Hospital — For 9 Days

The Medusa ransomware gang, believed to operate out of Russia, has claimed responsibility for a devastating February cyberattack on the University of Mississippi Medical Center — the state's only children's hospital, Level I trauma center, and organ transplant facility. The hospital went completely dark for nine days, forcing staff to manage cancer infusions, surgeries, and critical care with paper and pen. Medusa...

🎣 Hackers Are Posing as PayPal & Amazon Support — And Stealing Your MFA Codes in Real Time

Researchers discovered attackers are hijacking LiveChat — the same support tool used by thousands of legitimate companies — to impersonate PayPal and Amazon agents in real time. Victims are lured via phishing emails, connected to a fake live chat, coaxed into sharing credit card numbers and MFA codes, and then redirected to fake login pages where their credentials are captured. The MFA bypass is the criti...

🤖 Bing AI Promotes Fake GitHub Repos with Malware 🤖

Microsoft Bing's AI search feature promoted fake OpenClaw GitHub repositories that deployed infostealers and proxy malware, marking the first major case of AI search engines serving malicious content.

• BleepingComputer: https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/

• The Register: https://www.theregister.com/2026/03/04/fake_openclaw_installers_malware/

• Security Boul...