Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

JINX-0164 uses sophisticated social engineering via LinkedIn profiles impersonating recruiters or business partners to deliver macOS malware. The attack chain includes: 1) Credible LinkedIn contact with fake meeting invites, 2) Malicious domains masquerading as conferencing platforms delivering AUDIOFIX Python-based infostealer or MINIRAT Go-based backdoor, 3) Credential harvesting from password managers, browsers, SSH keys, cloud credentials, and cryptocurrency wallets, 4) Lateral movement into CI/CD systems using stolen GitHub tokens and nord-stream tool, 5) Code injection into repositories with developer impersonation via Git commit manipulation. The malware uses AES-256-CBC encryption, communicates over HTTPS with C2 domains (datahub.ink, cloud-sync.online, byte-io.us), establishes persistence via launchctl, and includes TCC bypass and password phishing capabilities. Supply chain attacks involved trojanizing @velora-dex/sdk npm package.