JINX-0164 Targeting Cryptocurrency Developers with macOS Malware

The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.

Executive Summary

JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting macOS-using software developers in the cryptocurrency sector. The group employs highly credible social engineering on platforms like LinkedIn, posing as recruiters to lure victims into fake virtual meetings. These meetings lead to the execution of malicious payloads, most notably AUDIOFIX, a Python-based infostealer, and MINIRAT, a lightweight Go-based backdoor.

The actor's tradecraft involves moving laterally from compromised developer endpoints into internal CI/CD pipelines and code distribution systems. In a significant 2026 operation, JINX-0164 successfully conducted a supply chain attack by trojanizing the @velora-dex/sdk npm package. While the actor shares technical similarities with North Korean groups like Sapphire Sleet, JINX-0164 maintains unique technical implementations and separate infrastructure, focusing on exfiltrating cloud secrets and cryptocurrency wallet data.