# JINX-0164: A New Threat Actor Weaponizes Recruitment Lures and Supply Chain Tactics Against Crypto Firms
A previously undocumented threat actor tracked as JINX-0164 has been conducting a sophisticated campaign targeting cryptocurrency organizations and developers since at least mid-2025, combining social engineering, custom malware, and supply chain attacks to steal digital assets and compromise critical infrastructure. According to research from Wiz security researchers, the group employs recruitment-themed social engineering paired with a bespoke macOS infostealer and remote access trojan called AUDIOFIX, alongside a Go-based backdoor named MiniRAT distributed through compromised open-source packages.
The campaign represents a significant escalation in threats to the cryptocurrency sector, moving beyond simple credential theft to compromise of development environments, code repositories, and active wallets.
## The Attack Chain: From LinkedIn to Malware Installation
JINX-0164's primary attack vector begins with credible LinkedIn profiles posing as recruiters or hiring managers. The threat actor initiates contact with cryptocurrency developers and engineers, offering what appear to be legitimate job opportunities at established technology firms.
The social engineering flow operates as follows:
1. Initial Contact: Victim receives a personalized message via LinkedIn from what appears to be a legitimate recruiter
2. Meeting Invitation: Target is invited to a virtual meeting or technical interview
3. Malicious Redirect: The meeting link directs to a counterfeit teleconference provider domain designed to mimic legitimate video conferencing platforms
4. Fake Error Message: Victims encounter a fabricated technical error, instructing them to download a "fix" or "driver update"
5. Malware Delivery: The downloaded installer triggers retrieval of AUDIOFIX malware via bash script from apple.driver-store[.]com
The sophistication of this approach lies in its multi-stage nature—each step feels legitimate to the victim, building confidence at each interaction point before the compromise occurs.
## AUDIOFIX: A Purpose-Built macOS Infostealer and RAT
AUDIOFIX is the primary payload in JINX-0164's arsenal, designed specifically to target macOS systems. The malware is distributed as an architecture-aware payload compatible with both Intel and Apple Silicon chips—a technical detail indicating careful engineering for maximum compatibility and impact.
Key Capabilities of AUDIOFIX:
| Function | Purpose |
|----------|---------|
| Credential Theft | Exfiltrates passwords from Safari, Chrome, and macOS Keychain |
| SSH Key Harvesting | Collects SSH keys and configuration files |
| Crypto Asset Targeting | Steals cryptocurrency extension data and wallet addresses |
| Session Hijacking | Captures active Discord, Slack, and Telegram sessions |
| Lateral Movement | Injects payloads into CI/CD and code distribution systems |
| Source Code Modification | Alters repository code to compromise downstream targets |
| Remote Command Execution | Executes arbitrary shell commands for ongoing access |
| Data Exfiltration | Uploads stolen files to attacker-controlled servers |
The malware masquerades as a legitimate system component—specifically coreaudiod, the macOS audio driver—before being saved as "ChromeUpdater" and executed via launchctl. This obfuscation tactic delays detection by endpoint security tools that rely on file signature recognition.
## Supply Chain Compromise: The npm Package Attack
Beyond direct targeting, JINX-0164 has demonstrated capability in supply chain attacks, compromising legitimate open-source packages to distribute malware at scale. Security researchers at SafeDep and StepSecurity documented the poisoning of @velora-dex/sdk, a legitimate decentralized finance (DeFi) toolkit used by developers building on the VeloraDEX protocol.
The compromised package version downloaded a shell script that delivered MiniRAT, a Go-based backdoor with the following capabilities:
This approach is particularly dangerous because it leverages trust in open-source ecosystems. Developers integrating @velora-dex/sdk for legitimate DeFi functionality unknowingly downloaded malware, expanding the attack surface exponentially across dependent projects and organizations.
## Who Gets Hit: The Cryptocurrency Development Community
JINX-0164 explicitly targets:
The focus on developers is strategic—a single compromised developer account provides access to:
From a single compromised MacBook, JINX-0164 has achieved lateral movement into production infrastructure, modifying source code to further compromise downstream systems.
## Attribution and Motivation
While Wiz researchers note similarities to activity patterns associated with North Korean threat actors, including use of commercial VPN services (Astrill VPN) and focus on cryptocurrency theft, formal attribution remains provisional. What is clear is that JINX-0164 is financially motivated, actively working to steal cryptocurrency and digital assets.
The group's operational tempo suggests a dedicated team with:
## HackWire Analysis
JINX-0164 represents a critical inflection point in cryptocurrency sector threats: the convergence of human-targeting social engineering with infrastructure-level compromise. This isn't simply credential theft or wallet draining—it's the hijacking of development pipelines to inject compromises at the source.
What makes this campaign dangerous isn't any single technical breakthrough. Rather, it's the *combination* of tactics that turns a single social engineering success into an organizational catastrophe. A developer downloads malware, but suddenly the firm's CI/CD pipeline is poisoned. Source code is modified. Every build artifact from that moment forward carries the compromise. Lateral movement spreads to production wallet systems. By the time detection occurs, months of wallet activity may already be compromised.
The cryptocurrency sector has historically focused security efforts on infrastructure hardening—hardware wallets, air-gapping, multi-sig controls. JINX-0164 sidesteps all of this by targeting the humans and processes that manage those controls. This reflects a maturation in threat actor tradecraft: why attack the fortress when you can convince someone inside to open the gate?
The supply chain attack component—the @velora-dex/sdk compromise—reveals a second vulnerability: the open-source ecosystem's dependency on trust. Package registries like npm operate on reputation-based security. JINX-0164 has proven that reputation can be compromised, and when it is, the impact cascades to every dependent project.
For defenders, this campaign demands a reset of priorities. Technical controls remain essential, but social engineering resistance, supply chain verification, and behavioral monitoring of development accounts must move to the top tier. The cryptocurrency industry's native paranoia about security should extend beyond digital asset custody to encompass the humans and processes that manage cryptographic keys and code deployment.
— HackWire Editorial
## Defensive Recommendations
Organizations in cryptocurrency and financial services should implement the following:
## Related Coverage