Six malicious pull requests targeting the Vizor and Zingo cryptocurrency wallets were identified, none of which were merged. The coordinated campaign embedded a build-time credential stealer within the proposed code changes. The attackers paired the malicious payload with instructions designed to deceive AI-powered code review tools, directing them to ignore specific uploads during the review process. This dual approach aimed to bypass both human and automated security checks before the compromised code could enter production builds.