Ankura CTIX FLASH Update – May 29, 2026

Malware Activity

How Modern Cybercriminals Are Blending Social Engineering with Advanced Malware to Expand Financial Attacks

Recent threat activity shows a clear shift in how cybercriminals are targeting organizations and individuals, combining highly convincing social engineering with increasingly advanced malware across multiple platforms. A group known as JINX‑0164 is focusing on cryptocurrency companies by impersonating recruiters and luring developers into fake meetings, where victims unknowingly install macOS malware that steals credentials, wallet data, and access to collaboration tools. Once inside, attackers move deeper into development environments and even manipulate code pipelines, sometimes escalating into supply chain attacks that spread infections further. At the same time, separate campaigns involving Grandoreiro and BTMOB are targeting financial institutions and users in Latin America and Europe, using phishing emails and fake applications to infect both Windows