JINX-0164 is reported as a North Korea-linked financially motivated cluster targeting cryptocurrency firms and developers through fake LinkedIn recruiter lures, spoofed meeting sites, and macOS malware. AUDIOFIX steals wallet extension data, desktop wallet credentials, browser credentials, SSH keys, cloud tokens, collaboration tokens, Telegram data, and clipboard history, then exfiltrates them to operator C2 infrastructure. The group also compromised `@velora-dex/sdk` version 4.9.1 to install the Go-based MiniRAT backdoor in developer and CI/CD environments. Wiz assessed the activity as behaviorally consistent with North Korean cryptocurrency-theft operations, while noting no confirmed infrastructure overlap with previously tracked DPRK clusters.