Wiz identified JINX-0164, a previously unreported financially motivated actor targeting cryptocurrency organizations and developers through LinkedIn recruitment/business lures, fake conferencing pages, and malicious macOS “fix” scripts. The actor deploys AUDIOFIX, a Python infostealer/backdoor that steals wallet, browser, cloud, GitHub, CI/CD, and local macOS secrets, then uses stolen development credentials to access code distribution systems and inject malware into internal repositories. JINX-0164 also trojanized @velora-dex/sdk version 4.9.1 on npm to deliver the Go-based MINIRAT backdoor, showing supply-chain capability against cryptocurrency software infrastructure. Wiz notes tactical similarities to North Korea-linked groups such as UNC1069/Sleet and Sapphire Sleet, but found distinct implementations and no infrastructure overlap, so it does not attribute the activity to a state sponsor.