Loading malware…
AUDIOFIX is a compiled Python-based macOS infostealer and backdoor/RAT used by the financially motivated threat cluster JINX-0164 in campaigns active since at least mid-2025. It has been used primarily against software developers at cryptocurrency organizations and financial firms via recruitment-themed social engineering, including fake LinkedIn recruiter outreach, bogus virtual meeting pages, and fake teleconference or driver-update sites. In documented intrusions, victims were tricked into downloading and executing a bash script from apple.driver-store[.]com, which fetched architecture-aware payloads for Intel and Apple Silicon macOS systems. The payload masqueraded as a system audio component named coreaudiod, was saved as ChromeUpdater, and was executed via launchctl; persistence was also established through LaunchAgents plist files.
AUDIOFIX steals a broad range of data from compromised macOS hosts, including credentials from local password storage vaults, macOS Keychain/iCloud Keychain data, browser credentials and history, local administrator credentials, SSH keys, configuration files, console history, clipboard data, and active sessions from Slack, Discord, and Telegram. It also targets cloud and developer secrets, including AWS, Azure, GCP, Cloudflare, version-control, and package-management credentials and API tokens, and steals cryptocurrency wallet extension data, wallet addresses, and related browser extension information. Reported capabilities also include arbitrary shell command execution, manual reconnaissance, file deletion, payload retrieval, and support for lateral movement by injecting malicious payloads into internal repositories and development infrastructure.
JINX-0164 used stolen GitHub tokens and the nord-stream tool to exfiltrate CI/CD secrets and abused compromised developer access to alter internal code repositories, impersonate legitimate developers through modified commit metadata, and propagate malware to additional developers who pulled and built infected branches. Researchers reported AUDIOFIX communicating with command-and-control infrastructure including datahub[.]ink; one report also states it used HTTPS with AES-256-CBC encryption. Additional indicators and artifacts directly mentioned include apple.driver-store[.]com, the filenames coreaudiod and ChromeUpdater, execution via launchctl, and an XOR-encoded password stored in ~/.zsh_cache observed on compromised endpoints.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The primary utility is AUDIOFIX, which functions as a compiled Python information stealer . This malicious application actively harvests sensitive credentials from local password storage vaults .
31 distinct techniques documented for this family, organized by ATT&CK tactic.
the stolen credentials were leveraged to access internal code distribution systems and development infrastructure.
Clicking the link triggers the download of a macOS-specific remote access tool that silently begins stealing sensitive data from the moment it runs.
On April 7, 2026, JINX-0164 conducted a supply chain operation by trojanizing version 4.9.1 of the npm package @velora-dex/sdk.
The attacks leverage fake recruitment offers and masquerade as teleconference providers or system drivers to trick victims into installing the malicious payloads.
The attacks begin with a convincingly crafted LinkedIn profile reaching out to targets under the guise of a business opportunity or a job offer. Once trust is established, victims receive a meeting invitation linked to a fake conferencing platform page designed to look like Microsoft Teams or similar services.
The primary utility is AUDIOFIX, which functions as a compiled Python information stealer.
the stolen credentials were leveraged to access internal code distribution systems and development infrastructure.
Specifically, AUDIOFIX collects Keychain files, browser history data, and active secure shell keys.
Persistence is then established via LaunchAgent with RunAtLoad and KeepAlive flags, masquerading as legitimate applications including Microsoft Teams
the stolen credentials were leveraged to access internal code distribution systems and development infrastructure.
Specifically, AUDIOFIX collects Keychain files, browser history data, and active secure shell keys.
The invitation included a link to a malicious domain disguised as a legitimate conferencing platform, such as Microsoft Teams. After interacting with the link, the victim executed a malicious file disguised as the meeting client.
a self-destruct capability allows operators to remotely wipe all traces: unloading the LaunchAgent, deleting persistence files, clearing logs, purging server-side data, and removing the malware binary itself.
Password phishing: A macOS dialog box, mimicking a "System Update" prompt, requests the user's password. The malware validates the entered password...
The malware also compromises active sessions from communication utilities like Slack and Discord.
The malware accomplished this by extracting cloud infrastructure secrets, such as AWS, GCP, and Azure keys, and Cloudflare API tokens, as well as version control and package management credentials.
This malicious application actively harvests sensitive credentials from local password storage vaults... Specifically, AUDIOFIX collects Keychain files
GitHub tokens were utilized to deepen the compromise and steal more secrets by exfiltrating GitHub Actions Secrets directly from CI/CD pipelines.
83 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS compiled Python information stealer used to harvest developer credentials and secrets, including Keychain files, browser history, SSH keys, Slack and Discord sessions, and AWS and Azure keys.
Python-based infostealer and remote access trojan used to steal credentials, SSH keys, and cryptocurrency wallet information, and to enable lateral movement within victim networks.
A compiled Python-based macOS infostealer and backdoor used to steal browser credentials, wallet extensions, SSH keys, cloud API tokens, clipboard data, and communication-platform session data. It communicates with C2 over encrypted HTTPS, establishes persistence via launchctl, and was also propagated through compromised internal repositories as part of a supply-chain style spread.
A bespoke Python-based macOS infostealer and remote access trojan used to steal credentials and wallet-related data, support lateral movement into development and code distribution systems, modify source code, and provide remote capabilities including reconnaissance, exfiltration, shell command execution, file deletion, and payload retrieval.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.