North Korean Hackers Weaponize Crypto Dev Pipelines via Fake LinkedIn

Published by James Harris on June 6, 2026June 6, 2026

A North Korean-linked hacker group has been using fake LinkedIn meeting invitations to plant macOS malware inside crypto development teams, then using those infected machines to poison the very software pipelines those developers maintain. The malware does not just steal credentials; it turns internal CI/CD infrastructure into its own distribution network.

Wiz’s incident response team, which published its findings on May 27, 2026, tracked the group (designated JINX-0164) back to at least mid-2025. The attack chain is methodical: a convincing LinkedIn profile, a fake Teams meeting link, and a macOS payload called AUDIOFIX that masquerades as a system audio component and survives reboots. Once installed, it harvests Keychain passwords, SSH keys, browser credentials, and cloud access tokens for AWS, GCP, and Azure. The more consequential step comes after: stolen GitHub tokens let the attackers extract secrets from CI/CD pipelines using an open-source tool called nord-stream, then inject AUDIOFIX into internal repositories under forged developer identities, so every colleague who pulls and builds from those repos gets infected automatically. This is the same technique used in the 2020 SolarWinds compromise, where the build pipeline itself became the attack surface, and it remains underdefended in most organizations because the threat model assumes external perimeter breaches, not internal workflow hijacking.

GitHub’s Vigilant Mode, which flags commits without verified GPG signatures, caught the impersonation in at least one documented case. That one feature did more than most of the organization’s other controls.

On April 7, 2026, JINX-0164 also trojanized version 4.9.1 of the npm package @velora-dex/sdk, deploying a Go-based backdoor called MINIRAT through a base64-encoded command. That attack is part of a broader pattern: in May, over 170 npm and PyPI packages were compromised in a separate campaign, including the official Mistral AI Python library, in what became the first documented case of malicious packages carrying valid SLSA Build Level 3 provenance attestations. SLSA attestations are the cryptographic trust layer the open-source ecosystem has been building toward precisely to prevent this kind of supply chain compromise, so their successful forgery removes one of the few remaining automated defenses developers have been told to rely on. For DeFi protocols and crypto infrastructure teams, where a single poisoned dependency can propagate a wallet-draining payload to every user of a deployed contract, the exposure is direct and financial, not just operational.

Wiz found tactical overlaps with North Korean clusters UNC1069 and Sapphire Sleet but stopped short of a firm attribution, designating JINX-0164 as a distinct actor. That distinction matters less than the pattern it confirms: state-adjacent groups targeting crypto developers are no longer content with phishing for private keys. They are after the code itself, the deployment infrastructure, and the organizational access that lets malicious commits reach production without triggering obvious alerts. Any crypto team running CI/CD pipelines on GitHub should be auditing recent commits for unverified signatures and reviewing third-party package dependencies updated in the last six months.