JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS Malware

JINX-0164 is a newly documented threat actor targeting cryptocurrency companies using fake recruiter social engineering and custom macOS malware to facilitate digital asset theft.

• •The threat actor uses fake LinkedIn recruiter profiles to trick victims into downloading AUDIOFIX malware through rogue domains masquerading as teleconference providers
• •AUDIOFIX is a Python-based infostealer and RAT that steals credentials from password managers, browsers, iCloud Keychain, SSH keys, and cryptocurrency extensions
• •The attacker performs lateral movement to CI/CD infrastructure and development systems, modifying source code to compromise other endpoints and steal cryptocurrency wallet credentials
• •MiniRAT, a Go-based backdoor, was distributed via a poisoned npm package (@velora-dex/sdk) targeting cryptocurrency developers