JINX-0164
- First seen
- 2025-06-01 00:00:00
- Origin
- KP
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- team
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:29:33
Targeted industries: financial-services technology-and-telecommunications
Context
JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting software developers through recruitment-themed social engineering to steal cryptocurrencies and conduct supply chain attacks. Their operations have focused on macOS devices, utilizing malware such as AUDIOFIX and MINIRAT, with a notable supply chain compromise involving the trojanization of an npm package. The actor employs a shell script for initial system profiling and payload delivery, often spoofing legitimate services like Microsoft Teams and cryptocurrency companies. JINX-0164's infrastructure includes numerous lookalike domains and utilizes VPN exit nodes for accessing victim systems.
Reports & references
- wiz.io — Threat Actors Target Crypto Orgs (report)