Inside JINX-0164: Fake Recruiters, Custom macOS Malware, and the npm Supply Chain Attack Targeting Crypto

A Dual-Payload macOS Malware Arsenal

After the victim executes the initial lure, JINX-0164 delivers custom macOS payloads. Wiz identified two distinct components used in the campaign.

AUDIOFIX: Python-Based Infostealer

AUDIOFIX is a Python infostealer built specifically for macOS and delivered through the social-engineering lures . Its primary job is to locate and exfiltrate cryptocurrency wallet data, private keys, and other developer secrets from the victim's machine .

MINIRAT: Go-Based Remote Access Trojan

MINIRAT is a fully-featured Go-based macOS RAT that provides persistent backdoor access. Its capabilities include arbitrary shell command execution, file exfiltration, and the ability to download and launch secondary payloads .

The trojan uses several stealth techniques:

• Anti-VM Evasion: It includes checks to detect if it is running inside a virtual machine, likely to thwart automated malware analysis sandboxes .
• Encrypted C2 Traffic: Command-and-control communication is conducted over HTTPS with an AES-encrypted configuration .
• Stealthy Persistence: MINIRAT installs a LaunchAgent disguised as an Apple system component (com.apple.Terminal.profiler), ensuring it relaunches every time the user logs in .

The Supply Chain Attack: How MINIRAT Spreads via npm

A particularly dangerous vector for MINIRAT was a pure registry-level supply chain attack. On April 7, 2026, threat actors published a malicious version (v9.4.1) of the legitimate @velora-dex/sdk package to the npm registry .

The attack was stealthy by design. Instead of relying on install scripts or suspicious post-install hooks—commands often caught by security tooling—the attackers injected just three lines of malicious code directly into dist/index.js. The payload executed the very moment any developer require()'d or import'd the compromised package .

This code would fetch a remote shell script, which in turn downloaded and persisted the MINIRAT backdoor on the macOS system using the LaunchAgent technique . The package appeared to be a useful DeFi toolkit, making it a highly effective trojan horse for targeting developers in the crypto space.

Beyond the Laptop: CI/CD Infrastructure Hijacking

JINX-0164's ambition extends past single developer endpoints. Wiz reports that after gaining a foothold on a victim's laptop, the actor moved laterally to compromise CI/CD pipelines and broader development infrastructure .

This stage of the attack is critical because it turns a single compromised laptop into a potential risk to the entire software delivery lifecycle. By accessing build systems and code repositories, a threat actor could inject malicious changes into trusted internal applications or even official releases, dramatically scaling the impact of the intrusion .

The North Korea Connection

The threat intelligence community has not ignored the familiar tradecraft on display. JINX-0164's operational profile closely mirrors campaigns long attributed to North Korean state-sponsored groups, particularly the Lazarus Group (also tracked as AppleJeus, Contagious Interview, or DeceptiveDevelopment). The common DNA includes fake job lures on LinkedIn, targeting of cryptocurrency developers, and a sustained focus on macOS-specific malware .

ESET has documented North Korea-aligned groups using nearly identical playbooks for cryptocurrency theft and social engineering against freelance developers on Windows, Linux, and macOS . Despite these strong tactical overlaps, Wiz's official report stops short of declaring a definitive link to North Korea’s Lazarus Group, leaving the formal attribution open .

The campaign fits cleanly into a global pattern of state-aligned actors using IT workers and developers as a primary access vector. Mandiant and GitHub have both published findings on groups like Jade Sleet and clusters delivering COVERTCATCH malware via similar fake job coding challenges .

Why This Campaign Is a Warning for 2026

JINX-0164 reflects a dangerous fusion of attack trends that have been accelerating throughout 2025 and early 2026. It combines targeted social engineering, custom malware for an often-overlooked platform (macOS), and a registry-only npm supply chain attack. It also demonstrates an aggressive appetite for moving from endpoints into the development tools that mint, build, and distribute code.

For security teams in cryptocurrency and Web3 organizations, the lesson is stark: a single developer falling for a polished LinkedIn pitch can lead to a cascade of compromises from personal wallets to core build infrastructure. The ability to detect and respond requires visibility not only on endpoints, but into package registries, import-time behavior, and the CI/CD systems that sit downstream.