Most cloud intrusions still start with a person: a phished login, a stolen password, a session token lifted off a laptop. Wiz Research says the extortion gang it began tracking this year as JINX-0163 skips that step and goes after non-human identities instead, the service accounts and IAM roles that hold cloud infrastructure together.
The group appears in Wiz's half-year review of cloud threat activity, compiled by the company's Research and CIRT teams, and was first surfaced by one of its AI-enabled threat hunting systems. Wiz says JINX-0163 operates seamlessly across AWS, Azure, GCP, Okta and Snowflake, and that in some cases a single over-privileged identity or an exposed state file has been enough for the group to pivot and obtain a full inventory of an organization's secrets.
In the most severe incident Wiz attributes to the group, JINX-0163 compromised a cloud-hosted AI development platform. It gained initial access to one GCP service account, moved laterally, and extracted thousands of secrets spread across multiple GCP projects, including customer credentials.
Why machine accounts
Service accounts and IAM roles are the credentials software uses to authenticate to other software, so nobody is watching them log in. They tend to outlive the project that created them and are often granted more permission than their job needs. That is what makes Wiz's observation sting: one over-scoped role, or one state file left where it can be read, can be worth more to an attacker than any individual employee's password.
The extortion end
Wiz assesses that JINX-0163's data theft operations are financially motivated and designed to further extortion schemes. Multiple victims have received threats from an actor identifying itself as FulcrumSec, claiming to hold terabytes of victim data and threatening to release it if it is not paid. Wiz assesses with moderate confidence that FulcrumSec is the public-facing identity for JINX-0163, while stating it cannot rule out an extortion-as-a-service model in which multiple actors play different roles. Wiz says it has deployed focused detections for the group's activity in customer environments.
A record half-year
The rest of the report puts numbers behind a noisy six months. The volume of significant incidents Wiz highlighted to customers was up 60% from the second half of 2025, the highest the company has seen in a single period and nearly double the first half of 2025. Notable supply chain attacks more than doubled their share, going from about 10% of significant incidents to 25%, and spanned npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR, several of which had not been targeted this way before. New vulnerability disclosures Wiz highlighted roughly doubled, a trend it ties to the broader acceleration in AI-assisted vulnerability research and weaponization, and activity targeting AI infrastructure roughly doubled as well. Exploitation of internet-facing appliances stayed fairly constant in volume but slipped from 30% of incidents to 17% as the other categories grew around it.
Wiz also tracks stolen credentials moving between crews. Keys taken in TeamPCP's npm campaigns were reused weeks later by what Wiz believes were different groups, and in at least one case a company extorted by LAPSUS$ had originally been compromised through a key stolen in a TeamPCP campaign. IntelFusions has covered a ransomware crew partnering with TeamPCP and an npm worm that spread itself to 400 packages.
What you should do
For the package supply chain, Wiz points to a shrinking window: community pressure has cut how long a malicious package stays downloadable, which it says gives enterprises room to set cooldown policies that refuse any package published less than 24 hours ago. For the identity side, the JINX-0163 pattern points at the unglamorous work: inventory the service accounts and IAM roles that already exist, cut the ones nobody owns, scope down the ones that can read everything, and treat an exposed state file as a credential leak rather than a configuration slip.
The full half-year review is on the Wiz research blog.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.