Malicious Pull Requests Target Vizor and Zingo Wallets

A coordinated campaign of six malicious pull requests targeted the Vizor and Zingo wallet projects, pairing credential-stealing code with instructions telling AI code reviewers not to flag secret uploads. None of the six requests was merged, so no funds or credentials are known to have been compromised. The incident highlights the growing reliance on AI-assisted code review in crypto development and the risk that embedded prompts can steer automated reviewers away from suspicious changes. What to watch next is whether other projects audit their bot-reviewed pull requests for similar prompt-injection tactics and whether maintainers add human checks on dependency and secret-handling changes.