Previously unknown threat group uses fake recruiting lures and custom malware to target digital asset organisations.
- New threat actor JINX-0164 identified targeting cryptocurrency organisations
- Campaign uses recruitment-themed social engineering and custom macOS malware
- Attackers specifically target CI/CD infrastructure for digital asset theft
Security researchers have identified a new threat actor, designated JINX-0164, conducting targeted attacks against cryptocurrency organisations using sophisticated social engineering and custom macOS malware.
The campaign employs recruitment-themed lures to deceive employees at digital asset firms, according to research published by Wiz Security. The threat actor has developed bespoke malware specifically designed for macOS systems.
Researchers Shira Ayal from Wiz noted that the campaigns demonstrate advanced targeting capabilities, with particular focus on continuous integration and continuous deployment (CI/CD) infrastructure within victim organisations.
The attacks represent a continuation of the trend where cryptocurrency firms face heightened targeting due to the valuable digital assets they manage. The use of fake recruitment scenarios as an initial attack vector suggests the threat actor has conducted reconnaissance on target organisations to craft convincing lures.
The identification of JINX-0164 as a previously undocumented threat actor indicates the emergence of new groups specifically focused on cryptocurrency theft. The development of custom macOS malware suggests significant resources and technical capability within the threat group.
The targeting of CI/CD infrastructure is particularly concerning as these systems often have elevated privileges and access to critical business processes within technology organisations, including cryptocurrency platforms.
Why It Matters
This campaign highlights the continued evolution of threats targeting cryptocurrency organisations, with adversaries developing platform-specific malware and sophisticated social engineering techniques. For CISOs in financial services and cryptocurrency sectors, this demonstrates the need for enhanced employee security awareness training focused on recruitment-themed attacks.
The targeting of CI/CD infrastructure represents a strategic shift towards attacking development and deployment processes, which could enable persistent access and supply chain compromises beyond immediate asset theft.
What To Do Now
- Review and strengthen security controls around recruitment processes and employee communications based on the Wiz Security research
- Implement additional monitoring and security controls for CI/CD infrastructure as highlighted in the threat analysis
- Enhance endpoint detection capabilities for macOS systems in cryptocurrency and financial technology environments
