JINX-0164 Targets Crypto Firms With macOS Malware

A series of targeted intrusions against cryptocurrency organizations, attributing the activity to a newly identified threat actor tracked as JINX-0164.

The campaign combines advanced social engineering, custom macOS malware, and deep access into development and CI/CD environments, enabling attackers to pivot from individual developer endpoints to critical software distribution systems.

The group primarily targets developers using recruitment-themed lures, often impersonating legitimate business contacts on LinkedIn to establish trust before delivering malware.

A detailed case study from early 2026 highlights the full attack lifecycle. The intrusion began with a convincing LinkedIn outreach offering a virtual meeting.

Victims were directed to a malicious domain mimicking a conferencing platform such as Microsoft Teams. Once the victim downloaded and executed the fake client, a Python-based macOS malware known as AUDIOFIX was deployed via a bash script hosted on a spoofed Apple driver domain.

The malware, disguised as a system audio component named coreaudiod and executed through launchctl, established persistence and communicated with command-and-control servers over HTTPS.

Wiz researchers said in a report shared with GBhackers, JINX-0164 has been active since at least mid-2025 and appears financially motivated, with a strong focus on stealing cryptocurrency assets and high-value credentials.

It was capable of harvesting extensive sensitive data, including macOS Keychain credentials, browser data, SSH keys, cloud tokens, and cryptocurrency wallet information.

Evidence also shows password phishing activity, with XOR-encoded credentials stored locally on compromised systems.

JINX-0164 Targets Crypto Firms

JINX-0164 leveraged the stolen credentials to move laterally, not through traditional cloud exploitation, but by targeting internal development infrastructure.

The key indicators were the unverified badge on the malicious commits, alongside the historical affiliation of the GPG key with the compromised user, signaling a mismatch between the user who signed the commit and the listed commit author. 

GitHub tokens enabled the attackers to extract secrets directly from CI/CD pipelines using tools such as nord-stream.

The threat actor then injected malicious code into repositories, often impersonating legitimate developers by modifying commit metadata or pushing directly to main branches in unprotected projects.

This approach effectively turned development environments into propagation vectors. When other developers pulled and built compromised code, additional systems were infected, expanding the attacker’s foothold.

In some cases, GitHub’s Vigilant Mode helped detect anomalies through unverified commits and mismatched signing identities.

Beyond endpoint compromise, JINX-0164 has demonstrated supply chain attack capabilities. On April 7, 2026, the group trojanized version 4.9.1 of the npm package @velora-dex/sdk.

The malicious modification injected a base64-encoded command into the package, which executed a remote script to deploy MINIRAT, a lightweight Go-based backdoor.

Unlike AUDIOFIX, MINIRAT focuses on persistence and remote command execution rather than large-scale data exfiltration.

Both malware families share overlapping infrastructure, including command-and-control domains such as datahub.ink, cloud-sync.online, and byte-io.us.

The attackers also used VPN services including Mullvad, Astrill, and ExpressVPN to obscure their activity across cloud and SaaS environments.

While JINX-0164 shares some tactical similarities with known North Korean threat clusters like UNC1069 and Sapphire Sleet, researchers found no direct infrastructure overlap, indicating a distinct and previously untracked actor.

The group’s consistent focus on macOS systems and developer-centric environments highlights a strategic shift toward exploiting software supply chains and cryptocurrency ecosystems.

Security teams are advised to closely monitor endpoint activity, audit logs, and CI/CD workflows for anomalies. Particular attention should be given to unusual VPN usage, unauthorized GitHub Actions activity, unverified commits, and suspicious package updates.

The campaign underscores the growing risk of developer-targeted attacks and the increasing convergence of social engineering, malware, and supply chain compromise in modern threat operations.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.