JINX-0164 reveals a threat that unites social engineering and multiplatform malware to steal assets and sabotage the supply chain

A new group of threats identified by the Wiz firm, which have been baptized as JINX-0164, has exposed a dangerous mix of highly directed social engineering and custom malware for macOS with the explicit objective of stealing digital assets and compromising software supply chains. According to the analysis published by the researchers, the actor has been active since at least mid-2025 and focuses his efforts on developers and code infrastructure equipment, taking advantage of false recruitment processes and simulated virtual meetings to introduce his malware into development environments and CI / CD.

The social vector is particularly sophisticated: credible profiles in LinkedIn contact victims by offering interviews or recruitment, and the so-called virtual meeting is served from fraudulent domains that mimic video conference providers. The meeting link leads to an installer who, when running, downloads a sequencer that invokes a infostealer in Python and a remote access Trojan named AUDIOFIX, all orchestrated from false domains with appearance of Apple driver stores. The binaries were designed to be compatible with both Intel and Apple Silicon, camouflaged as a system audio driver and executed by launchctl, techniques that make it difficult to detect by unprevented users.

From the committed endpoint, the attackers do not stay in the theft of local credentials: they take advantage of the access to move laterally to code distribution systems and development pipeline. In one or more documented incidents, the attackers even modified source code with the intention of spreading the intrusion to other machines or intercepting cryptomoneda keys and wallets. Exfiltered artifacts include passwords from managers and browsers, iCloud Keychain files, local administration credentials, SSH keys, console histories, crypto wallet extensions and addresses, and active sessions on Telegram, Discord and Slack.

The campaign also reuses another technique recently observed in the JavaScript ecosystem supply chain: the distribution of a backdoor written in Go called MiniRAT through a committed version of a npm package associated with a DeFi project. This vector shows two clear lessons: DeFi developers and platforms are high-value targets, and third-party units remain a single point of failure for critical environments.

The implications for organizations that handle digital assets or develop software are severe. First, the combination of directed social engineering and the use of legitimate tools disguised (installers, drivers, meeting tools) increases the probability of success and complicates signature-based detection only. Second, the ability to move from developer workstations to CI / CD pipelines makes an initial commitment to a systemic risk of software integrity and loss of funds.

To mitigate such threats, it is critical to implement both technical and organizational measures. At the technical level, it is appropriate to force the centralized management of macOS endpoints through MDM, to block the execution of binaries not signed or notarized by policies, and to monitor calls to launchctl, downloads from suspicious domains and unusual CLI activity. At the CI / CD level, isolation controls between workstations and pipelines should be implemented, credentials should be segregated (not stored private keys or tokens on development machines), the immediate rotation of keys and tokens should be enabled after any suspicion and reproducible and verifiable signatures for binaries and deployment devices should be used. In addition, continuous unit scanning and setting of versions (lockfiles) in package managers such as npm reduce the exposure window to compromised packages. For risk guides in supply chains and best practices, it is appropriate to review official materials such as CISA: https: / / www.cisa.gov / supply-chain.

In the human and process aspects, it is essential to raise suspicion in the face of unexpected contacts that ask to run software, especially if they come with the excuse of an interview or a technical "fix." Independent channel verification of any job or assembly offer, specific training for engineers and internal recruiters, and clear procedures for validating installers (e.g., checking digital signatures and hashes with official sources) are low cost and high impact controls. Organizations that publish vacancies or recruit remotely should audit and filter associate recruiters' accounts and centralize calls through official corporate tools.

If you suspect an infection, response actions should prioritize containment: isolate affected endpoints from the network, preserve forensic images of compromised systems, collect commitment indicators (domains, hashes, PIs), and rotate all affected credentials (both human and machine). Review and restore the integrity of artifacts in the pipelines from clean sources and verify reproducibility of the code before reinstating production deployments are key steps to avoid a second gap. For resources and technical documentation on the safety of open-source packages and ecosystems, the official npm documentation provides practical recommendations: https: / / docs.npmjs.com /.

Finally, although some operational features - such as the use of VPN services and the focus on cryptomonedas - recall campaigns by certain state groups, Wiz clarifies that, for now, there are no overlaps in infrastructure that allow for confidence in North Korean actors. This caution in attribution underlines a broader truth: financial motivation and technical adaptability are driving a new generation of threats that mix social engineering, supply chain and multiplatform malware. For organizations in the crypto ecosystem and for development teams, the question is no longer whether they will be objective, but when; preparing and implementing specific controls can make the difference between a contending incident and irreversible asset loss.