Recent threat activity shows a clear shift in how cybercriminals are targeting organizations and individuals, combining highly convincing social engineering with increasingly advanced malware across multiple platforms. A group known as JINX‑0164 is focusing on cryptocurrency companies by impersonating recruiters and luring developers into fake meetings, where victims unknowingly install macOS malware that steals credentials, wallet data, and access to collaboration tools. Once inside, attackers move deeper into development environments and even manipulate code pipelines, sometimes escalating into supply chain attacks that spread infections further. At the same time, separate campaigns involving Grandoreiro and BTMOB are targeting financial institutions and users in Latin America and Europe, using phishing emails and fake applications to infect both Windows and Android devices. Grandoreiro focuses on stealing banking credentials through sophisticated evasion techniques, while BTMOB enables attackers to gain remote control over mobile devices and access sensitive data. Together, these campaigns highlight how financially motivated actors are expanding their reach by targeting multiple entry points, including employees, devices, and software ecosystems, while blending human manipulation with technical precision to drive larger and more scalable cyberattacks. CTIX analysts will continue to report on the latest malware strains and attack methodologies.