JINX-00164 Threat Actor Uses LinkedIn to Deploy macOS Malware
Key Takeaways A new threat actor, JINX-0164, is targeting cryptocurrency organizations and developers through sophisticated social engineering on LinkedIn. The group deploys custom macOS malware,...
Key Takeaways
- A new threat actor, JINX-0164, is targeting cryptocurrency organizations and developers through sophisticated social engineering on LinkedIn.
- The group deploys custom macOS malware, AUDIOFIX and MINIRAT, capable of extensive data theft and persistent remote access.
- Initial infections lead to supply chain attacks by injecting malicious code into development repositories and trojanizing legitimate npm packages.
- Attackers use commercial VPNs and actively tamper with Git commit metadata to evade detection and impersonate developers.
Threat Actor JINX-0164 Leverages LinkedIn for macOS Malware Deployment
A recently identified threat actor, dubbed JINX-0164, is orchestrating highly targeted campaigns against cryptocurrency firms, exploiting LinkedIn to trick developers into downloading custom macOS malware. Active since at least mid-2025, this financially motivated group seamlessly integrates social engineering, credential theft, and supply chain sabotage, posing a significant risk to the software development lifecycle.
Table Of Content
The attackers initiate contact via meticulously crafted LinkedIn profiles, presenting enticing business or job opportunities. Once a rapport is established, targets receive meeting invitations directing them to counterfeit conferencing platforms, meticulously designed to mimic services like Microsoft Teams. Clicking these deceptive links triggers the download of a macOS-specific remote access tool, which then stealthily begins exfiltrating sensitive data.
The JINX-0164 Modus Operandi
Security researchers at Wiz.io, who identified and named the JINX-0164 threat cluster, have detailed multiple intrusions against cryptocurrency organizations. In a report shared with Cyber Security News, Wiz CIRT and Wiz Research confirmed the actor’s financial motivation and their deployment of two distinct macOS malware families: AUDIOFIX and MINIRAT.
AUDIOFIX: A Comprehensive macOS Infostealer
AUDIOFIX is a Python-based infostealer and backdoor, designed to harvest a wide array of sensitive information. This includes browser credentials, cryptocurrency wallet extensions, SSH keys, cloud API tokens, and real-time clipboard data. The malware establishes encrypted HTTPS communication with its command-and-control (C2) server using AES-256-CBC encryption and can dynamically adjust polling intervals to evade detection. Furthermore, AUDIOFIX targets active sessions on popular communication platforms such as Discord, Slack, and Telegram, providing attackers with a broad overview of a victim’s digital activities. For a detailed breakdown of the attack chain and malware capabilities, refer to the Wiz.io’s detailed report.
Initial Compromise and Lateral Movement
A documented attack chain unfolded over two weeks, escalating from a LinkedIn message to a full infrastructure compromise. After a developer clicked a malicious meeting link, a bash dropper script hosted on a fake driver update domain delivered the AUDIOFIX payload. The malware disguised itself as a legitimate system audio component, named coreaudiod, and was saved as ChromeUpdater. It achieved persistence by launching through launchctl.
Upon gaining a foothold, AUDIOFIX proceeded to harvest credentials from macOS Keychain, web browsers, and cloud configuration files, including AWS, GCP, Azure keys, and Cloudflare API tokens. Attackers then leveraged stolen GitHub tokens to exfiltrate secrets from CI/CD pipelines using the open-source tool nord-stream. They further propagated the infection by pushing malicious code into shared repositories, ensuring that any developer pulling from those branches would unknowingly incorporate the AUDIOFIX malware.
Supply Chain Attack via Trojanized npm Package
On April 7, 2026, JINX-0164 broadened its attack surface by targeting the software supply chain directly. The group surreptitiously modified version 4.9.1 of the npm package @velora-dex/sdk, a widely used cryptocurrency SDK. This modification appended code designed to download and execute a shell script whenever the package was imported into any project.
This shell script then delivered MINIRAT, a lightweight Go-based backdoor. While MINIRAT doesn’t perform automated data theft on the same scale as AUDIOFIX, it provides operators with persistent remote access, command execution capabilities, and file transfer functionality. Importantly, in this particular incident, only the npm credentials were compromised, with the corresponding GitHub source code remaining untampered. Additional technical details and indicators of compromise are available in the Wiz.io blog post.
What You Should Do
- Implement EDR Solutions: Deploy robust Endpoint Detection and Response (EDR) solutions across all endpoints, especially macOS devices, to detect and respond to anomalous activity.
- Enhance Audit Logging: Enable comprehensive audit logging by default across all cloud platforms (AWS, GCP, Azure), version control systems (GitHub), and CI/CD pipelines.
- Monitor Version Control Systems: Actively monitor GitHub for unverified commits, commits with mismatched or unsigned authors, and unusual activity from specific Git committers like
nord-stream / [email protected]. Consider enabling GitHub Vigilant Mode. - Scrutinize Network Traffic: Watch for unexpected VPN usage from commercial providers such as ExpressVPN, Astrill VPN, and Mullvad VPN, which attackers use to mask their activities.
- Review CI/CD Pipeline Activity: Continuously monitor CI/CD pipelines for anomalous workflow activity, unauthorized changes, and the use of tools like nord-stream for secret exfiltration.
- Verify New Package Publications: Flag and investigate any new code package publications originating from unfamiliar or suspicious IP addresses.
- Strengthen Social Engineering Defenses: Educate developers and employees about the risks of sophisticated social engineering attacks via LinkedIn and other professional networking platforms. Emphasize caution with unsolicited job offers or business opportunities.
- Implement Multi-Factor Authentication (MFA): Enforce MFA on all critical accounts, especially for developer tools, cloud platforms, and social media.
- Regularly Rotate Credentials: Implement a policy for regular rotation of API keys, tokens, and other sensitive credentials, particularly for GitHub, npm, and cloud services.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | 0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 |
MINIRAT ARM64 |
| SHA-256 | 0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba10875f5 |
MINIRAT x86_64 |
| SHA-256 | a35d2b67fa478a7174e308b43ce30bf69b3bc6f44fa76197fdf95fc2fbc1cf7d |
MINIRAT ARM64 (variant) |
| SHA-256 | 65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c7a8b4 |
AUDIOFIX HTTPS/ARM64 |
| SHA-256 | 0b1a36a31b952341a534fe24890f1ed2921ee259773cff46e4f6273b8c4d5e3a |
AUDIOFIX HTTPS/x86_64 |
| SHA-256 | e8ee6f5145c9d503c5130bfc6585567f6e19d409158c3c0ca0b259f1875b1a2f |
AUDIOFIX Dropbox/ARM64 |
| SHA-256 | 3e3901519c2305fbe9d5483b7234c25c6d2b562512916481d96f26b849c7d4e1 |
AUDIOFIX Dropbox/x86_64 |
| SHA-256 | 9c2ce925133a3bf5a924063bbef8df49918d5b7258695c1894cd18c75970157a |
Dropper – Fake audio fix (apple.driver-store.com) |
| SHA-256 | 402625ec79e3573a80b6de9b33fc1e503e3c7803603cd958ddd515fb0e4a3c91 |
Dropper – Fake audio fix (apple.driver-update.io) |
| SHA-256 | b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb4f2d89 |
Dropper – Fake audio fix (driver-updater.net) |
| SHA-256 | d4e863f9818bfb2f1dd932df6441dff204e6142c3bdb55b298cb08dc7b6a9f12 |
Dropper – Fake Chrome update (apple.driver-store.com) |
| SHA-256 | c6ef82d2864dfd26f117a1ef5602679153423f2742970a7949cec72722f0a0b3 |
Dropper – Supply chain (89.36.224.5) |
| SHA-256 | 2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb339f4d5c |
Dropper – Supply chain (89.36.224.5, variant) |
| Domain | datahub[.]ink |
Primary C2 domain (resolves to 208.115.220.17 / 185.175.59.85) |
| Domain | cloud-sync[.]online |
Backup C2 domain |
| Domain | byte-io[.]us |
Backup C2 domain |
| Domain | apple[.]driver-store[.]com |
Payload delivery domain |
| Domain | apple[.]driver-update[.]io |
Payload delivery domain |
| Domain | driver-updater[.]net |
Payload delivery domain |
| Domain | driver-hub[.]net |
Payload delivery domain |
| Domain | drvstore[.]com |
Payload delivery domain |
| Domain | bitget-meeting[.]com |
Meeting spoofing domain |
| Domain | teamicrosoft[.]com |
Meeting spoofing domain (Teams impersonation) |
| Domain | teams[.]cam |
Meeting spoofing domain |
| Domain | live[.]us[.]org |
Meeting spoofing domain |
| Domain | us03-slack[.]online |
Meeting spoofing domain (Slack impersonation) |
| Domain | live[.]ong |
Meeting spoofing domain |
| IP Address | 89[.]36[.]224[.]5 |
Payload delivery server |
| IP Address | 185[.]100[.]85[.]250 |
Meeting spoofing infrastructure |
| IP Address | 84[.]32[.]83[.]250 |
Meeting spoofing / payload delivery infrastructure |
| IP Address | 153[.]92[.]126[.]84 |
Meeting spoofing infrastructure |
| IP Address | 45[.]45[.]217[.]242 |
Meeting spoofing infrastructure |
| IP Address | 163[.]172[.]53[.]20 |
Meeting spoofing / payload delivery infrastructure |
| IP Address | 208[.]115[.]220[.]17 |
C2 server (datahub.ink) |
| IP Address | 185[.]175[.]59[.]85 |
C2 server (datahub.ink) |
| File Path | ~/Library/LaunchAgents/com.microsoft.teams.coreaudiod.plist |
Persistence mechanism (Python RAT) |
| File Path | ~/Library/LaunchAgents/io.aircall.workspace.helper.plist |
Persistence mechanism (Python RAT) |
| File Path | ~/Library/LaunchAgents/com.apple.Terminal.profiler.plist |
Persistence mechanism (MINIRAT) |
| File Path | ~/.zsh_cache |
XOR-encoded stolen macOS password |
| File Path | /helper.log |
Malware activity log |
| File Path | /tokens.txt |
Exfiltrated Discord tokens |
| File Path | /clip |
Clipboard capture log |
| File Name | ChromeUpdater |
AUDIOFIX payload saved under this name |
| File Name | coreaudiod |
Payload masquerading as system audio driver |
| npm Package | @velora-dex/sdk v4.9.1 |
Trojanized npm package used in supply chain attack |
| AES Key | v59l2uwlow9s1ebuscgfg9k9r4voxkbs |
Shared AES key found in both AUDIOFIX and MINIRAT samples |
| Git Committer | nord-stream / nord-stream@localhost.
|
No Comment! Be the first one.