JINX-0164 Targets Crypto Developers With macOS Malware and a Malicious npm Package
Summary
Wiz describes JINX-0164 campaigns targeting cryptocurrency developers with social engineering, macOS malware, credential theft and CI/CD compromise, including a trojanized npm package used to deliver a backdoor.
Key points
- Wiz says JINX-0164 has been active since at least mid-2025 and appears financially motivated, targeting cryptocurrency organizations and developers.
- Recruitment-themed social engineering led victims to fake meeting pages and macOS malware disguised as an audio fix.
- AUDIOFIX steals credentials, wallet-related data, cloud secrets and communication-app sessions, and can provide remote access.
- Stolen developer credentials were used to access CI/CD secrets and inject malware into internal code repositories, potentially infecting employees who built from them.
- In April 2026, the actor trojanized version 9.4.1 of the @velora-dex/sdk npm package to download MINIRAT, a Go backdoor.
- Wiz recommends endpoint monitoring, review of cloud and GitHub audit logs, and hunting for unverified commits, anomalous workflows and package publications.
Article Details
- Attack Vectors
- JINX-0164 used recruitment-themed social engineering and meeting invitations containing links to spoofed conferencing or help pages to deliver macOS malware.
- AUDIOFIX was delivered through Bash dropper scripts hosted on fake driver-update domains; the scripts selected an architecture-specific payload and executed it.
- The actor stole credentials and secrets from compromised developer endpoints, then used GitHub tokens to access internal code distribution systems and exfiltrate GitHub Actions Secrets.
- The actor inserted AUDIOFIX into internal repositories using impersonated commit metadata, direct commits to unprotected main branches, or existing branches, causing infections when employees updated and built the code.
- JINX-0164 trojanized version 9.4.1 of the npm package @velora-dex/sdk. The modified package downloaded a shell script that installed MINIRAT.
- AUDIOFIX and MINIRAT communicated with hard-coded C2 domains; an earlier AUDIOFIX variant used Dropbox for bidirectional C2 and exfiltration.
- Defensive Notes
- Monitor endpoints for the listed malware indicators and related behaviors, and search across available log sources.
- Enable and review cloud storage logs and IP logging in GitHub audit logs; correlate Git push activity with the initially compromised endpoint.
- Hunt for GitHub Actions Secrets exfiltration, unexpected CI/CD workflows, unexpectedly deleted workflow logs, and new packages published from anomalous IP addresses.
- Review GitHub commits for unverified badges and mismatches between the listed commit author and the historical affiliation of the GPG key.
- Monitor for unexpected use of Express VPN, Astrill VPN, and Mullvad VPN, and search code resources for malware components and use of nord-stream.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bitget-meeting[.]com | JINX-0164 meeting-spoofing domain. |
| DOMAIN | byte-io[.]us | Hard-coded backup C2 domain used by AUDIOFIX and MINIRAT. |
| DOMAIN | cloud-sync[.]online | Hard-coded backup C2 domain used by AUDIOFIX and MINIRAT. |
| DOMAIN | datahub[.]ink | Primary hard-coded C2 domain used by AUDIOFIX and MINIRAT. |
| DOMAIN | driver-hub[.]net | JINX-0164 fake driver-update domain used for payload delivery. |
| DOMAIN | driver-store[.]com | JINX-0164 fake driver-store domain used for payload delivery. |
| DOMAIN | driver-update[.]io | JINX-0164 fake driver-update domain used for payload delivery. |
| DOMAIN | driver-updater[.]net | JINX-0164 fake driver-update domain used for payload delivery. |
| DOMAIN | drvstore[.]com | JINX-0164 fake driver-store domain used for payload delivery. |
| DOMAIN | live[.]ong | JINX-0164 meeting-spoofing domain. |
| DOMAIN | live[.]org[.]mx | JINX-0164 meeting-spoofing domain. |
| DOMAIN | live[.]us[.]org | JINX-0164 meeting-spoofing domain. |
| DOMAIN | lives[.]us[.]org | JINX-0164 meeting-spoofing domain. |
| DOMAIN | retesta[.]live | JINX-0164 meeting-spoofing domain. |
| DOMAIN | slktest[.]live | JINX-0164 Slack-spoofing domain. |
| DOMAIN | teamicrosoft[.]com | JINX-0164 meeting-spoofing domain. |
| DOMAIN | teams[.]cam | JINX-0164 meeting-spoofing domain. |
| DOMAIN | teams[.]us[.]org | JINX-0164 meeting-spoofing domain. |
| DOMAIN | us03-slack[.]online | JINX-0164 Slack-spoofing domain. |
nord-stream@localhost[.]com | Default committer email listed as a nord-stream code indicator. | |
| HOSTNAME | app[.]slktest[.]live | JINX-0164 Slack-spoofing hostname. |
| HOSTNAME | app[.]us03-slack[.]online | JINX-0164 Slack-spoofing hostname. |
| HOSTNAME | apple[.]driver-hub[.]net | JINX-0164 fake driver-update hostname used for payload delivery. |
| HOSTNAME | apple[.]driver-store[.]com | JINX-0164 fake driver-store hostname used to deliver AUDIOFIX. |
| HOSTNAME | apple[.]driver-update[.]io | JINX-0164 fake driver-update hostname used to deliver a malicious dropper. |
| HOSTNAME | apple[.]drvstore[.]com | JINX-0164 fake driver-store hostname used for payload delivery. |
| HOSTNAME | learn[.]bitget-meeting[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | learn[.]live[.]ong | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | learn[.]retesta[.]live | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | learn[.]teamicrosoft[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | learn[.]teams[.]cam | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | learn[.]teams[.]us[.]org | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | live[.]teams[.]cam | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | login[.]bitget-meeting[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | login[.]live[.]ong | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | login[.]retesta[.]live | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | login[.]teamicrosoft[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | login[.]teams[.]cam | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | my-home-company-group[.]slktest[.]live | JINX-0164 Slack-spoofing hostname. |
| HOSTNAME | my-home-company-group[.]us03-slack[.]online | JINX-0164 Slack-spoofing hostname. |
| HOSTNAME | resource[.]bitget-meeting[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | resource[.]teamicrosoft[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | sitemaps[.]driver-store[.]com | Listed as part of JINX-0164's fake driver-store payload-delivery infrastructure. |
| HOSTNAME | team[.]live[.]us[.]org | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | teams[.]live[.]ong | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | teams[.]live[.]org[.]mx | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | teams[.]live[.]us[.]org | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | teams[.]retesta[.]live | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | windows[.]driver-hub[.]net | JINX-0164 fake driver-update hostname. |
| HOSTNAME | windows[.]driver-store[.]com | JINX-0164 actor-controlled driver-store hostname identified as possible Windows-targeting infrastructure. |
| HOSTNAME | windows[.]driver-update[.]io | JINX-0164 fake driver-update hostname. |
| HOSTNAME | windows[.]drvstore[.]com | JINX-0164 fake driver-store hostname. |
| HOSTNAME | www[.]bitget-meeting[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]driver-hub[.]net | JINX-0164 fake driver-update hostname. |
| HOSTNAME | www[.]driver-store[.]com | JINX-0164 fake driver-store hostname. |
| HOSTNAME | www[.]driver-update[.]io | JINX-0164 fake driver-update hostname. |
| HOSTNAME | www[.]drvstore[.]com | JINX-0164 fake driver-store hostname. |
| HOSTNAME | www[.]live[.]ong | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]live[.]us[.]org | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]retesta[.]live | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]slktest[.]live | JINX-0164 Slack-spoofing hostname. |
| HOSTNAME | www[.]teamicrosoft[.]com | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]teams[.]cam | JINX-0164 meeting-spoofing hostname. |
| HOSTNAME | www[.]us03-slack[.]online | JINX-0164 Slack-spoofing hostname. |
| IPV4 | 153[.]92[.]126[.]84 | IP address resolved by JINX-0164 spoofing and payload-delivery domains. |
| IPV4 | 163[.]172[.]53[.]20 | IP address resolved by JINX-0164 spoofing and payload-delivery domains. |
| IPV4 | 185[.]100[.]85[.]250 | IP address resolved by JINX-0164 meeting-spoofing domains. |
| IPV4 | 185[.]100[.]85[.]98 | IP address resolved by JINX-0164 spoofing and payload-delivery domains. |
| IPV4 | 185[.]175[.]59[.]85 | IP address listed for the primary C2 domain datahub.ink. |
| IPV4 | 208[.]115[.]220[.]17 | IP address listed for the primary C2 domain datahub.ink. |
| IPV4 | 45[.]45[.]217[.]242 | IP address resolved by JINX-0164 meeting-spoofing and payload-delivery domains. |
| IPV4 | 84[.]32[.]83[.]250 | IP address resolved by JINX-0164 spoofing and payload-delivery domains. |
| SHA256 | 0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 | MINIRAT ARM64 malware sample. |
| SHA256 | 0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d | MINIRAT x86_64 malware sample. |
| SHA256 | 0b1a36a31b952341a534fe24890f1ed2921ee259773cff46e4f6273b8c4d5d21 | AUDIOFIX HTTPS/x86_64 malware sample. |
| SHA256 | 2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460 | Dropper delivered through the supply-chain operation. |
| SHA256 | 3e3901519c2305fbe9d5483b7234c25c6d2b562512916481d96f26b849c39fdb | AUDIOFIX Dropbox/x86_64 malware sample. |
| SHA256 | 402625ec79e3573a80b6de9b33fc1e503e3c7803603cd958ddd515fb0549007c | Fake audio-fix dropper script. |
| SHA256 | 65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6 | AUDIOFIX HTTPS/ARM64 malware sample. |
| SHA256 | 9c2ce925133a3bf5a924063bbef8df49918d5b7258695c1894cd18c75970157a | Fake audio-fix dropper script. |
| SHA256 | a35d2b67fa478a7174e308b43ce30bf69b3bc6f44fa76197fdf95fc2fbc1cf5b | MINIRAT ARM64 malware sample. |
| SHA256 | b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17 | Fake audio-fix dropper script. |
| SHA256 | c6ef82d2864dfd26f117a1ef5602679153423f2742970a7949cec72722f0a01e | Dropper delivered through the supply-chain operation. |
| SHA256 | d4e863f9818bfb2f1dd932df6441dff204e6142c3bdb55b298cb08dc7b6a0c62 | Fake Chrome-update dropper script. |
| SHA256 | e8ee6f5145c9d503c5130bfc6585567f6e19d409158c3c0ca0b259f1875b15f4 | AUDIOFIX Dropbox/ARM64 malware sample. |
| URL | hxxp[:]//89[.]36[.]224[.]5/troubleshoot/mac/install[.]sh | Shell script URL used by the trojanized npm package to deliver MINIRAT. |
| URL | hxxps[:]//apple[.]driver-update[.]io/troubleshoot/mac/audio-issue-fix[.]sh | Malicious Bash dropper URL provided by the fake meeting help page. |
| URL | hxxps[:]//learn[.]bitget-meeting[.]com/en-us/troubleshoot/microsoftteams/teams-on-mac/teams-audio-issue-mac | Fake meeting help page that directed the victim to install malware. |
MITRE ATT&CK
T1005 · Data from Local SystemAUDIOFIX collected local files and data including credentials, wallet information, histories, and application data.T1056.002 · GUI Input CaptureAUDIOFIX displayed a fake macOS password prompt and captured the password entered by the victim.T1059.004 · Unix ShellBash dropper scripts downloaded and executed payloads; MINIRAT also supports arbitrary shell-command execution.T1059.006 · PythonAUDIOFIX supported operator-triggered execution of arbitrary Python modules and remote Python code.T1071.001 · Web ProtocolsThe HTTPS AUDIOFIX variant used HTTPS for C2 communications.T1102.002 · Bidirectional CommunicationThe earlier AUDIOFIX variant used Dropbox for bidirectional command and control.T1105 · Ingress Tool TransferDropper scripts used curl to retrieve architecture-specific malware payloads from actor-controlled domains.T1115 · Clipboard DataAUDIOFIX continuously monitored and logged clipboard contents.T1195.002 · Compromise Software Supply ChainJINX-0164 trojanized the npm package @velora-dex/sdk to deliver MINIRAT through the software supply chain.T1204.002 · Malicious FileVictims were induced to execute a malicious file disguised as a meeting client or fix.T1543.001 · Launch AgentAUDIOFIX and MINIRAT established macOS persistence using LaunchAgents.T1552.001 · Credentials In FilesThe actor collected SSH keys, cloud credentials, configuration files, and other secrets stored on developer endpoints.T1555.001 · KeychainAUDIOFIX collected macOS Keychain contents from compromised endpoints.T1555.003 · Credentials from Web BrowsersAUDIOFIX harvested browser-stored credentials.T1565.001 · Stored Data ManipulationThe actor modified source code in internal repositories by inserting AUDIOFIX, so downstream builds could infect other employees.T1566.002 · Spearphishing LinkThe actor sent meeting invitations and links to fake meeting or help pages to deliver malicious content.T1567.002 · Exfiltration to Cloud StorageAn earlier AUDIOFIX variant used Dropbox for data exfiltration.
Threat Actors
Malware
AUDIOFIXAfter clicking the embedded link and executing the program, the victim received AUDIOFIX, a Python-based macOS infostealer, via a bash script hosted on a fake driver store domain (apple.driver-store[.]com). miniratattempts to download a shell script whenever the package was imported. The shell script then downloads MINIRAT, a lightweight backdoor written in Go. Velora is a DEX aggregation protocol and the SDK is likely widely
Products
DropboxAn earlier AUDIOFIX variant was written to use Dropbox for exfiltration and as a command and control mechanism.GitHubOnce obtained from the local machine, GitHub tokens were utilized to deepen the compromise and steal more secrets by exfiltrating GitHub Actions Secrets directly from CI/CD pipelines. The attackers leveragedmacOSorganizations. These campaigns leveraged sophisticated social engineering techniques, custom macOS malware, and deep targeting of CI/CD infrastructure. The used methods enabled the threat actor to moveMicrosoft Teamsincluded a link to a malicious domain disguised as a legitimate conferencing platform, such as Microsoft Teams. After interacting with the link, the victim executed a malicious file disguised as the meetingnpmsupply-chain attack by distributing malicious versions of public packages through package managers such as npm, as the actor did earlier with the @velora-dex/sdk package on npm.