A previously undocumented threat actor tracked as JINX-0164 has launched targeted attacks against cryptocurrency firms using fake recruiter lures paired with custom macOS malware designed to steal digital assets.

The campaign combines two attack vectors. First, threat actors pose as recruiters to initiate contact with employees at cryptocurrency organizations, establishing trust before pivoting to malware delivery. Second, the attackers developed bespoke macOS malware to compromise victim systems once initial access succeeds.

Researchers at Wiz identified the operation and disclosed that JINX-0164 employs sophisticated social engineering alongside the malware component. The attackers specifically target CI/CD infrastructure, the systems cryptocurrency firms use to build, test, and deploy applications. Compromise of these pipelines allows attackers to inject malicious code into legitimate software updates or alter deployment processes to steal cryptocurrency holdings or authentication credentials.

The recruitment angle proves particularly effective against cryptocurrency workers. The industry experiences high employee turnover and frequent job searches, making recruitment-themed outreach appear legitimate. Threat actors likely research LinkedIn profiles or industry directories to identify targets by name and role, then initiate conversations about open positions or career opportunities. Once rapport develops, victims receive documents or files containing the macOS malware.

Custom malware development indicates JINX-0164 possesses above-average technical capability. Rather than relying on publicly available tools, the group built malware tailored to macOS systems, suggesting familiarity with Apple's security model and the need to avoid standard endpoint detection signatures.

The targeting of CI/CD infrastructure escalates risk considerably. These systems hold privileged access to source code repositories and production environments. A compromised pipeline creates opportunities for supply chain attacks affecting not just the targeted firm but potentially downstream customers and users.

Cryptocurrency organizations face heightened risk from this campaign. The sector remains attractive to threat actors due to the nature of digital