JINX-0164
JINX-0164 is a previously unreported, financially motivated threat actor tracked by Wiz, active since at least mid-2025. The actor targets cryptocurrency organizations, particularly software developers and development infrastructure, with the apparent objective of digital asset theft and theft of sensitive developer information. The group relies heavily on recruitment-themed social engineering, including credible fake LinkedIn recruiter or business-contact personas and fake virtual meeting invitations. Victims are directed to spoofed teleconferencing or driver-update domains and tricked into downloading malicious scripts or fixes. JINX-0164 uses custom macOS malware, primarily AUDIOFIX and MINIRAT. AUDIOFIX is described as a compiled Python-based macOS infostealer and backdoor/RAT that harvests Keychain data, browser credentials and history, local admin credentials, SSH keys, configuration files, console history, cloud and developer secrets, cryptocurrency wallet data, and active sessions from platforms including Slack, Discord, and Telegram. It also supports command execution, payload retrieval, reconnaissance, exfiltration, and persistence via launchctl/LaunchAgents. MINIRAT is a lightweight Go-based backdoor linked to the same infrastructure as AUDIOFIX. JINX-0164 focuses less on broad cloud-resource abuse and more on compromising internal code repositories, CI/CD systems, and enterprise deployment pipelines. Reported activity includes stealing GitHub tokens and CI/CD secrets, using the nord-stream tool to exfiltrate secrets, injecting malicious payloads into internal repositories, pushing malicious code to main branches when protections were absent, hijacking existing branches, and modifying Git committer names and email fields to impersonate legitimate developers. In at least one case, the actor conducted a software supply chain attack by trojanizing npm package @velora-dex/sdk version 4.9.1 to deliver MINIRAT; reporting indicates the GitHub source code was unchanged, suggesting compromise of npm credentials only. Known aliases and names directly mentioned in the content are limited to JINX-0164 / jinx_0164. Some reporting noted similarities to North Korean developer-targeting and cryptocurrency-focused tradecraft, including comparisons to BlueNoroff, Contagious Interview, and UNC1069, but the content explicitly states there was no infrastructure overlap and insufficient evidence for attribution to DPRK or another state actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Tradecraft
39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
91 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A financially motivated cluster conducting targeted social-engineering attacks against software developers at financial firms, delivering macOS malware to steal credentials and compromise enterprise deployment pipelines, including npm supply-chain abuse.
Targets cryptocurrency organizations using recruitment-themed social engineering and custom malware to steal digital assets and sensitive developer information.
Financially motivated attacks against cryptocurrency organizations using LinkedIn social engineering, fake meeting pages, macOS malware, credential theft, developer impersonation, CI/CD secret theft, and software supply chain compromise via a trojanized npm package.
Financially motivated threat actor targeting cryptocurrency organizations and software developers to steal digital assets. It uses recruiter impersonation, fake meeting platforms, macOS malware, lateral movement into CI/CD and development infrastructure, and supply chain compromise of software packages.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.