JINX-0164 Threat Actor Using LinkedIn Social Engineering to Deploy Custom macOS Malware

A new threat actor tracked as JINX-0164 has been running calculated attacks against cryptocurrency organizations, using LinkedIn profiles to lure developers into downloading custom macOS malware.

Active since at least mid-2025, the group has combined social engineering, credential theft, and supply chain sabotage into a seamless operation that puts the entire software development pipeline at risk.

The attacks begin with a convincingly crafted LinkedIn profile reaching out to targets under the guise of a business opportunity or a job offer.

Once trust is established, victims receive a meeting invitation linked to a fake conferencing platform page designed to look like Microsoft Teams or similar services.

Clicking the link triggers the download of a macOS-specific remote access tool that silently begins stealing sensitive data from the moment it runs.

Researchers at Wiz.io identified and named the threat cluster JINX-0164 after investigating multiple intrusions targeting cryptocurrency companies. 

Wiz CIRT and Wiz Research said in a report shared with Cyber Security News that this actor is financially motivated and has been deploying two distinct malware families, AUDIOFIX and MINIRAT, with a clear focus on macOS devices.

AUDIOFIX is a compiled Python-based infostealer and backdoor that harvests browser credentials, cryptocurrency wallet extensions, SSH keys, cloud API tokens, and even clipboard data in real time.

It communicates with its command-and-control server over encrypted HTTPS, using AES-256-CBC encryption, and can quietly switch to randomized polling intervals to avoid detection.

The malware also targets active sessions on communication platforms like Discord, Slack, and Telegram, giving attackers a wide view into a victim’s digital life.

The threat actor masked their network activity by routing connections through commercial VPN services, making attribution harder.

To further cover their tracks, they tampered with Git commit metadata to impersonate legitimate developers and pushed malicious code directly into internal repositories, turning the organization’s own development infrastructure into a delivery mechanism for further infections.

JINX-0164 Threat Actor Using LinkedIn Social Engineering

The attack chain unfolded over a two-week period in one documented case, moving from a LinkedIn message to full infrastructure compromise.

Once a developer clicked the fake meeting link, AUDIOFIX was downloaded via a bash dropper script hosted on a fake driver update domain.

The payload disguised itself as a system audio component named coreaudiod and was saved as ChromeUpdater, launched through launchctl to establish persistence.

After gaining a foothold, the malware harvested credentials from macOS Keychain, browsers, and cloud configuration files, including AWS, GCP, and Azure keys, as well as Cloudflare API tokens.

GitHub tokens were then used to exfiltrate secrets from CI/CD pipelines using an open-source tool called nord-stream. The attacker pushed infected code into shared repositories, which then spread AUDIOFIX to every developer who pulled and built from those branches.

Supply Chain Attack via Trojanized npm Package

On April 7, 2026, JINX-0164 escalated by targeting the broader software supply chain. The group quietly modified version 4.9.1 of the npm package @velora-dex/sdk, a widely used cryptocurrency SDK, appending code that would download and execute a shell script whenever the package was imported by any project.

That shell script delivered MINIRAT, a lightweight Go-based backdoor that registers infected machines with the same command-and-control infrastructure used by AUDIOFIX.

Although MINIRAT does not perform the same broad automated data theft, it provides operators with persistent remote access and the ability to execute commands and move files.

Only npm credentials were compromised in this incident, as the source code on GitHub remained unmodified.

Organizations are advised to deploy an Endpoint Detection and Response solution and enable audit logging across all cloud platforms and version control systems by default.

Security teams should watch for unverified commits in GitHub, unexpected VPN usage from providers like ExpressVPN, Astrill VPN, and Mullvad VPN, and any anomalous workflow activity in CI/CD pipelines.

Enabling GitHub Vigilant Mode can help surface developer impersonation attempts through unsigned or mismatched commits. Teams should also monitor for the use of nord-stream and flag any new code package publications originating from unfamiliar IP addresses.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.