Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.
- NodeRabbit gathers host data, runs shell commands, detects sandboxes, and rotates C2 servers
- PollCat supports file transfer, hidden process execution, and arbitrary JavaScript execution
- Fake colorized_terminal npm package bundled in node_modules launches NodeRabbit from a hidden cache path
- VS Code extension disguised as GitHub Copilot Helper and Git hooks provide persistence
- Defenders should verify recruiters, review dependencies, and isolate hiring assessments
- ATT&CK
- T1566.002 Spearphishing AttachmentT1204.002 Malicious FileT1176 Browser ExtensionsT1546.004 Unix Shell Configuration ModificationT1053.005 Scheduled Task
- Vendors
- PolySwarm
- Threat actors
- Mirage KittenUNC1549
- Malware
- NodeRabbitPollCat
- Organizations
- PolySwarm
- Countries
- EgyptEthiopiaAfghanistan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7 | s of compromise (IoCs):- Type Indicator Description SHA-256 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7 NodeRabbit-related sample identified by PolySwarm SHA-256 3 |
| sha256 | 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00 | 7 NodeRabbit-related sample identified by PolySwarm SHA-256 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00 NodeRabbit-related sample identified by PolySwarm Note: IP |
From the original article
3 min read at cybersecuritynews.com
Software developers are being targeted with fake job offers that turn routine coding tests into a path for remote access malware. The campaign uses recruiter personas on LinkedIn and other employment platforms to deliver projects that appear safe enough to run. The operation is attributed to the Iran-linked group Mirage Kitten, also known as UNC1549.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.