Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
72
Threat actor
Smoke Sandstorm
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 1, 2026
- Last mentionedSep 9, 2026
Timeline
2 articles · newest firstIranian cyber spies target aviation, fintech developers with new malware
Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.
75
Appears with
- Nimbus Manticorethreat actor · 2
- UNC1549threat actor · 2
- Microsoftvendor · 2
- Kasperskyvendor · 2
- NodeRabbitmalware · 2
- PollCatmalware · 2
- Mirage Kittenthreat actor · 2
- Cloudflareorganization · 1
- Microsoftorganization · 1
- Cloudflarevendor · 1
- Amazonvendor · 1
- NodeRabbitproduct · 1
- Fortinetvendor · 1
- GitHub Copilotproduct · 1
- Kasperskyorganization · 1
- PollCatproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.