JINX-0164 Hits Crypto Firms: AUDIOFIX Steals 51 Wallet Extensions via Fake Recruiter Lures

JINX-0164 cryptocurrency malware executes in four phases: recruitment lure, technical deception, malware delivery, and automated credential exfiltration.

Phase 1: LinkedIn recruitment lure. Operators build credible LinkedIn profiles posing as business contacts, investors, or talent recruiters within the cryptocurrency industry. They contact targets at crypto exchanges, DeFi protocols, and blockchain development companies with job opportunities or meeting invitations. The approach leverages industry-standard outreach that security-conscious professionals routinely accept.

Phase 2: Spoofed meeting domain. The invitation directs the target to a virtual meeting on an operator-controlled domain that impersonates a legitimate teleconference provider. Confirmed spoofing domains include teams.live.us[.]org (Microsoft Teams), bitget-meeting[.]com (Bitget exchange), and live[.]ong. During the meeting, a staged technical fault, a frozen screen, failed audio, camera error, creates the pretext for the next phase.

Phase 3: Malware delivery disguised as a fix. The victim is prompted to download and run a troubleshooting script or driver update. AUDIOFIX masquerades as a system audio driver (coreaudiod) and is architecture-aware, running natively on both Intel and Apple Silicon Macs. The payload is fetched from delivery domains including apple.driver-store[.]com (resolving to 89.36.224.5), apple.driver-update[.]io, and driver-updater[.]net.

Phase 4: Automated credential exfiltration. On first execution, AUDIOFIX conducts a complete credential sweep: it targets 51 browser-based cryptocurrency wallet extensions, 26 desktop wallet applications, credential stores across 7 browsers (Chrome, Firefox, Safari, Brave, Edge, Chromium variants), SSH private keys, AWS and GCP authentication tokens, Discord tokens, Slack workspace data, Telegram directory contents, and clipboard history with timestamps. Stolen data is exfiltrated to C2 domains datahub[.]ink, cloud-sync[.]online, and byte-io[.]us. AUDIOFIX also supports remote Python code execution, arbitrary shell commands, file deletion, and additional payload retrieval, transforming the infected machine into a persistent remote access foothold.

For developers who imported @velora-dex/sdk version 4.9.1, MiniRAT was silently installed via three lines appended to the package's dist/index.js file. MiniRAT provides a separate Go-based backdoor channel with file upload, download, compression, and shell execution capabilities, giving JINX-0164 a second persistent access path into any environment that builds with the compromised package.

JINX-0164 targets cryptocurrency organizations and the developers who build their infrastructure. Wiz confirmed multiple intrusions across cryptocurrency exchanges, DeFi protocol teams, and blockchain tooling companies. The April 7, 2026 supply chain attack on @velora-dex/sdk, a decentralized exchange SDK used by DeFi developers, demonstrates the group's intent to compromise not just individual employees but entire development pipelines and downstream users.

The role-specific targeting profile follows a consistent pattern across confirmed intrusions. JINX-0164 operators prioritize employees with access to cryptocurrency custody infrastructure: wallet administrators, blockchain engineers, protocol developers, and treasury managers. These roles hold private keys, seed phrases, and cloud authentication tokens that translate directly into financial theft at scale. A single successfully compromised wallet administrator at a cryptocurrency exchange can expose hundreds of millions of dollars in custodied assets.

The supply chain dimension extends the risk beyond direct targets. Developers who installed @velora-dex/sdk version 4.9.1 between April 7 and late April 2026 ran MiniRAT in their local build environments. Any CI/CD system that automatically resolved and installed this package, a standard practice in npm-based development workflows, received the backdoor without any user interaction. Source code modifications from MiniRAT's shell execution capability create potential for downstream software supply chain compromise affecting the users of any application built in that environment.

North Korean threat actors have established a proven playbook for cryptocurrency theft at this scale. The Bybit exchange heist of February 2025, attributed to North Korean Lazarus Group and resulting in $1.5 billion in losses, used similar social engineering vectors targeting developers with access to custody infrastructure. JINX-0164's focus on developer CI/CD environments through the Megalodon-style GitHub supply chain compromise pattern signals an escalation of this approach into the package ecosystem itself.

The broader developer credential theft risk is documented across multiple campaigns this year. The TanStack supply chain attack that exposed developer credentials on the dark web illustrates how compromised npm packages create persistent credential exposure long after the initial attack window closes, credentials stolen from developer CI/CD environments recirculate on dark web markets for months.

Wiz's analysis of JINX-0164 maps the campaign to seven MITRE ATT&CK techniques across the initial access, execution, and collection phases.

T1566.004, Spearphishing via Voice / Social Engineering: LinkedIn recruiter impersonation and spoofed meeting invitations represent a hybrid social engineering lure combining professional deception with technical failure theater. The campaign exploits the normalized practice of accepting LinkedIn connection requests and video meeting invitations in the cryptocurrency industry. (MITRE ATT&CK)

T1204.002, User Execution: Malicious File: AUDIOFIX and MiniRAT require user action to execute, the victim downloads and runs what they believe is a driver fix or troubleshooting script. The malware's coreaudiod naming and driver-store domain naming are designed to defeat casual inspection.

T1195.002, Supply Chain Compromise: Compromise Software Supply Chain: The @velora-dex/sdk npm supply chain attack on April 7 required no user interaction for developers whose CI/CD pipelines automatically resolved the package. This technique requires attackers to first compromise the package maintainer's npm account or registry access.

T1552.001, Unsecured Credentials: Credentials In Files: AUDIOFIX specifically sweeps for SSH private key files, AWS credential files (.aws/credentials), and GCP service account tokens in standard filesystem locations. These credentials provide lateral movement beyond the initial workstation.

T1539, Steal Web Session Cookie: AUDIOFIX extracts browser session cookies and authentication tokens, enabling account takeover of exchange accounts, developer portals, and cloud infrastructure without triggering MFA challenges.

T1555.003, Credentials from Password Stores: Credentials from Web Browsers: The malware systematically extracts saved passwords and stored credentials from all major browsers present on the infected system, prioritizing cryptocurrency-related sites and exchanges.

T1041, Exfiltration Over C2 Channel: All stolen credential packages are transmitted to the three C2 domains (datahub[.]ink, cloud-sync[.]online, byte-io[.]us) over encrypted HTTPS. Operators use ExpressVPN, Mullvad VPN, and Astrill VPN to mask cloud activity during the post-compromise access phase.

Detection of JINX-0164 cryptocurrency malware requires checks across process execution, file system, network activity, and package integrity.

Process and file system checks. Search for processes named coreaudiod running from non-standard locations outside of /usr/sbin/ or /System/Library/. Legitimate macOS coreaudiod lives at /usr/sbin/coreaudiod. Any coreaudiod binary in a user directory, /tmp, /var, or application support folder is anomalous. Run the command: sudo find / -name "coreaudiod" -not -path "/usr/sbin/coreaudiod" 2>/dev/null. Check for unexpected Python processes spawning from audio-related binary names.

Network indicators. Block and alert on outbound connections to datahub[.]ink, cloud-sync[.]online, byte-io[.]us, apple.driver-store[.]com, apple.driver-update[.]io, and driver-updater[.]net at the DNS and firewall layer. The IP addresses 185.100.85.250, 84.32.83.250, 153.92.126.84, 45.45.217.242, 208.115.220.17, 185.175.59.85, and 89.36.224.5 are associated with JINX-0164 infrastructure.

npm package audit. Any developer or organization that installed @velora-dex/sdk must audit package-lock.json and node_modules/.package-lock.json for version 4.9.1. Run: npm ls @velora-dex/sdk. If version 4.9.1 is present, treat the system as compromised. Check dist/index.js of the installed package for appended code fetching external URLs not in the original source.

Browser extension audit. Review installed browser extensions against your organization's approved list. AUDIOFIX targets 51 crypto wallet extensions, any extension with unexpected permissions to read clipboard contents or access all URLs warrants immediate review. Use Chrome's chrome://extensions/ page with Developer mode enabled to inspect extension IDs and source URLs.

LinkedIn contact verification. Any unexpected LinkedIn meeting invitation from a cryptocurrency recruiter, investor, or business contact requesting a virtual meeting should be verified through a second channel (email, Slack, phone) before the meeting link is clicked. Confirm the meeting domain matches the stated platform's official domain before joining.

Organizations in the cryptocurrency and blockchain development sectors need to act on JINX-0164 cryptocurrency malware indicators now. The following steps address the confirmed attack vectors across the fake recruiter lure, npm supply chain, and credential exfiltration phases.

JINX-0164 represents the continued evolution of North Korean cryptocurrency theft operations from broad credential phishing toward surgical targeting of the professionals who hold custody of digital assets at scale. Every confirmed JINX-0164 intrusion targeted someone with direct access to wallet infrastructure, not peripheral staff. The @velora-dex/sdk supply chain attack demonstrates that the group's operational reach now extends beyond direct social engineering into passive compromise of the development toolchain itself.

The 51 cryptocurrency wallet extensions and 26 desktop wallet applications that AUDIOFIX targets by name represent a comprehensive attack surface map of the crypto custody ecosystem. This is not opportunistic malware, it is precision tooling built for the specific purpose of extracting cryptocurrency at the infrastructure level.

The threat is not confined to large exchanges. DeFi protocols, NFT platforms, blockchain infrastructure companies, and individual developers with significant cryptocurrency holdings are all within JINX-0164's confirmed operational profile. Any macOS developer who works in cryptocurrency and received an unexpected LinkedIn recruiter message or meeting invitation in the past six months should treat that interaction as a potential JINX-0164 contact.

Organizations in adjacent sectors, fintech, traditional finance firms with crypto custody programs, gaming companies with in-game currency systems, should also review their developer security posture against these indicators. The npm supply chain vector specifically does not discriminate by organizational sector: it targets any developer who installs the compromised package.

Immediate action on the IOCs, the npm package audit, and the coreaudiod process check costs minutes. Failing to act costs wallets.