New Threat Actor JINX-164 Targets Crypto Firms with macOS Malware

LONDON — A previously undocumented cyber threat actor known as JINX-164 has launched a global campaign targeting cryptocurrency organizations, utilizing recruitment-themed social engineering and custom macOS malware to facilitate digital asset theft.

The campaign, identified on May 28, 2026, marks the first known activity from the group. Security researchers observed the operation targeting firms across multiple jurisdictions with the primary objective of financial gain. The attackers employed sophisticated social engineering tactics, posing as recruiters to gain initial access to victim networks. Once inside, they deployed bespoke malware designed specifically for macOS environments, a platform less frequently targeted than Windows systems in similar campaigns.

The malware appears engineered to bypass standard security controls and maintain persistence within compromised systems. The group's methodology involves sending unsolicited job offers to employees at cryptocurrency exchanges and wallet providers. These communications contain malicious attachments or links that, when opened, install the custom software. The software is designed to exfiltrate sensitive data, including private keys and credentials, enabling the theft of digital assets.

JINX-164 remains an enigmatic entity. No prior attribution has been made to the group, and their infrastructure and operational security techniques differ from known state-sponsored or criminal syndicates. The campaign's focus on macOS systems suggests a deliberate strategy to exploit a perceived gap in the defensive posture of cryptocurrency firms, many of which rely heavily on Apple devices for development and administrative tasks.

The scope of the attack remains under assessment. While initial indicators point to a concentrated effort against high-value targets, the global nature of the campaign suggests a broader reach. The financial impact has not been fully quantified, though early reports indicate potential losses in the millions of dollars across several targeted entities.

Security experts warn that the recruitment theme is particularly effective, as it bypasses traditional phishing filters by mimicking legitimate corporate communications. The use of custom malware further complicates detection, as signature-based defenses may fail to identify the unique code.

Questions remain regarding the group's ultimate capabilities and whether this campaign is part of a larger, coordinated effort. The lack of historical data on JINX-164 leaves open the possibility of more sophisticated attacks in the future. As the investigation continues, cryptocurrency organizations are advised to review their hiring protocols and enhance endpoint security measures to mitigate the risk of similar social engineering attacks.