Loading story…
Wiz disclosed a financially motivated threat actor tracked as JINX-0164 that has targeted cryptocurrency organizations since at least mid-2025 by impersonating recruiters on LinkedIn and directing developers to fake virtual meetings hosted on spoofed domains. Victims were tricked into downloading AUDIOFIX, a Python-based macOS infostealer and remote access trojan that enabled credential theft, collection of cloud secrets, and access to internal development environments. In one documented intrusion, the actor pivoted from an employee workstation into code repositories and CI/CD systems, then modified source code to further malware propagation and support cryptocurrency theft.
Researchers also linked JINX-0164 to a supply-chain compromise of the npm package @velora-dex/sdk on April 7, 2026, which delivered the Go-based MINIRAT backdoor. The campaign used spoofed infrastructure and VPN services including Mullvad, Astrill, and ExpressVPN, as well as tooling such as nord-stream to exfiltrate GitHub Actions secrets. While the tradecraft overlaps with cryptocurrency-focused North Korean activity such as UNC1069 and Sapphire Sleet, Wiz said there is not yet sufficient evidence to attribute JINX-0164 to a specific state sponsor.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Intrinsec reported that in March and April 2026, threat actors ran malicious spam campaigns delivering a heavily obfuscated JavaScript backdoor via ZIP or RAR attachments to targets in several countries and sectors.
Wiz said the previously untracked threat actor JINX-0164 has been active since at least mid-2025, using recruiter-themed social engineering to target developers at cryptocurrency firms and steal cryptocurrency-related assets.
In an early-2026 intrusion highlighted by Wiz, the actor used a malicious conferencing lure to install AUDIOFIX on macOS, steal credentials and cloud secrets, pivot into code repositories and CI/CD systems, and modify source code in pursuit of cryptocurrency theft.
Wiz disclosed the JINX-0164 campaign, detailing its fake recruiter lures, spoofed domains, AUDIOFIX macOS malware, MINIRAT linkage, and stating that similarities to North Korean tradecraft were insufficient for attribution.
Wiz linked JINX-0164 to a supply-chain attack on the npm package @velora-dex/sdk that delivered the Go-based MINIRAT backdoor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 105 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecyber.netsecops.io
Open sourcewiz.io
Open sourcethreats.wiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a broad software supply chain campaign targeting developers and cryptocurrency users through hijacked packages, browser extensions, and compromised maintainer accounts across ecosystems including **npm**, **Go**, **Chrome**, and **Packagist**. Socket linked the activity to North Korean actors associated with the **Contagious Interview** operation and identified 108 malicious packages and extensions spanning 162 release artifacts, while JFrog separately analyzed hijacked npm packages `html-to-gutenberg` `4.2.11` and `fetch-page-assets` `1.2.9` that were uploaded with malicious code. The activity appears to rely on account hijacking rather than compromise of GitHub itself, and some attacker infrastructure reportedly remains active even after certain packages were removed. The malware chain used unusual delivery and evasion techniques aimed at developer workstations, including a **VS Code folder-open task** instead of standard npm lifecycle scripts, JavaScript hidden in a fake font file, and encrypted payload retrieval from blockchain transaction data on **TRON**, **Aptos**, and **BNB Smart Chain**. Researchers said the campaign deployed components including **BeaverTail**, **DEV#POPPER RAT**, **OmniStealer**, a `socket.io` backdoor, and a Python infostealer to steal browser credentials, password-manager contents, cryptocurrency wallet data, developer secrets, and operating system credential-store material across **Windows**, **macOS**, and **Linux**. Security firms warned that affected developer systems and credentials should be treated as fully compromised.
Aug 3, 2026
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026