答案已發布7 天前Last edited 7 天前22 來源

黑客扮獵頭、滲透npm套件：JINX-0164組織如何用三部曲攻陷加密貨幣開發圈

JINX 0164係Wiz喺2026年5月踢爆嘅全新黑客組織，專向加密貨幣公司埋手，透過LinkedIn假獵頭、自訂macOS惡意軟件同供應鏈攻擊去偷錢，仲識得由開發人員電腦橫向移動到CI/CD基建 [1][2]。今次攻擊動用咗兩款全新惡意軟件：Python開發嘅AUDIOFIX負責偷加密錢包數據，Go語言嘅MINIRAT則係一個後門程式，透過惡意npm套件@velora dex/sdk散播，一行「import」指令就會觸發，唔使靠安裝鉤子都中招 [6][7][20]。

使用 Studio Global AI 搜尋並查核事實瀏覽更多熱門頁面

517K0

JINX-0164 threat actor targeting cryptocurrency organizations with fake recruiter lures and macOS malware — What is the newly disclosed threat actor JINX-0164, as identified by Wiz in May 2026, including its targeting of cryptocurrency organizationWiz Research identified the JINX-0164 campaign in May 2026, which uses recruitment-themed social engineering on LinkedIn and custom macOS malware to target cryptocurrency organizations.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What is the newly disclosed threat actor JINX-0164, as identified by Wiz in May 2026, including its targeting of cryptocurrency organization. Article summary: Here is the full picture of JINX-0164 based on Wiz's May 2026 disclosure and corroborating security research.. Topic tags: general, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "This article lists selected threat actors tracked by Palo Alto Networks Unit 42, using our specific designators for these groups. The information presented here is a list of threat" source context "Threat Actor Groups Tracked by Palo Alto Networks Unit 42 ..." Reference image 2: visual subject "# Threat Actors Merging Malicious Activity With Cryptocurrency Show How the Attack Landscape is Developing in Decentralized Finan
openai.com

2026年5月，雲端安全公司Wiz踢爆一個全新、以搵錢為目標嘅黑客組織，代號叫JINX-0164。呢個組織有系統咁針對加密貨幣同Web3公司，發動一條龍攻擊鏈，結合咗精心設計嘅社交工程、自家開發嘅macOS惡意軟件，同埋手法高明嘅軟件供應鏈入侵。成個行動嘅終極目標係偷走數碼資產，但佢嘅手段可以令攻擊者獲得開發環境同CI/CD管道（即係自動化程式碼整合同部署嘅基建）嘅深層權限。

以下就詳細拆解成個攻擊流程、用咗咩特製工具，同埋點解呢次攻擊代表緊加密貨幣界面對嘅威脅上升咗去另一個層次。

第一步：LinkedIn扮獵頭呃入門

JINX-0164唔係靠防火牆漏洞或者撞密碼嚟入侵網絡，而係喺LinkedIn上面開設像真度極高嘅假獵頭帳號，專向加密貨幣同Web3公司嘅開發人員埋手。

呢啲社交工程攻擊好有針對性，仲要好可信。騙徒會用吸引嘅職位空缺或者合作機會嚟接觸目標。一旦傾熟咗，就會叫受害者下載同執行一個偽裝成編程測試、視像會議工具或者會議應用程式嘅檔案。一執行，就即刻中招。

第二步：雙重macOS惡意軟件攻勢

當受害者執行咗最初嘅誘餌檔案之後，JINX-0164就會派送佢哋自家開發嘅macOS惡意程式。Wiz識別出兩款喺今次行動入面用過嘅工具。

AUDIOFIX：Python開發嘅「資訊小偷」

AUDIOFIX係一款專為macOS打造、用Python寫嘅資訊竊取程式，透過社交工程誘餌嚟派送。佢嘅主要任務係喺受害者部機度，搵出同偷走加密貨幣錢包資料、私密金鑰同其他開發人員機密。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜尋並查核事實

人們還問