What Happened
A new campaign orchestrated by a previously undocumented threat actor has targeted cryptocurrency organizations with an aim to facilitate digital asset theft using recruitment-themed social engineering and bespoke macOS malware. "These campaigns leveraged sophisticated social engineering techniques, custom macOS malware, and deep targeting of CI/CD infrastructure," Wiz researchers Shira Ayal,
Why It Matters
The report says JINX-0164 is targeting cryptocurrency organizations with recruitment-themed social engineering, custom macOS malware, and attempts to reach CI/CD infrastructure. Wiz says the attackers used fake LinkedIn recruiter lures, a malicious meeting flow, and malware that can steal credentials, move laterally, and alter source code. CyberSE.AI analysis: this fits an AI supply chain risk because compromise of development and build systems can propagate malicious changes into software delivery pipelines and downstream environments.
CyberSE Analysis
This signal maps to AI supply chain. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html