JINX-0164 is a financially motivated threat actor targeting software developers with recruitment-themed social engineering.
Analyst brief
JINX-0164 is a financially motivated threat actor active since mid-2025, targeting software developers via recruitment-themed social engineering. They compromise macOS devices using AUDIOFIX and MINIRAT malware, and conduct supply chain attacks through trojanized npm packages. Defenders should monitor for recruitment-themed phishing, lookalike domains, and unexpected package updates in the npm registry.
JINX-0164
unknown
JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting software developers through recruitment-themed social engineering to steal cryptocurrencies and conduct supply chain attacks. Their operations have focused on macOS devices, utilizing malware such as AUDIOFIX and MINIRAT, with a notable supply chain compromise involving the trojanization of an npm package. The actor employs a shell script for initial system profiling and payload delivery, often spoofing legitimate services like Microsoft Teams and cryptocurrency companies. JINX-0164's infrastructure includes numerous lookalike domains and utilizes VPN exit nodes for accessing victim systems.