Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Software developers are being targeted with fake job offers that turn routine coding tests into a path for remote access malware.

The campaign uses recruiter personas on LinkedIn and other employment platforms to deliver projects that appear safe enough to run. The operation is attributed to the Iran-linked group Mirage Kitten, also known as UNC1549.

It delivers NodeRabbit and PollCat, two newly documented remote access trojans that work on Windows, Linux, and macOS, placing valuable developer workstations at risk.

PolySwarm said in a report shared with Cyber Security News (CSN) that the campaign has affected organizations in fintech, aviation, and aerospace.

Analysts noted victims in Egypt, Ethiopia, and Afghanistan, while submissions of malicious archives suggest wider exposure. The threat matters because developers regularly download, inspect, and run unfamiliar code as part of hiring.

A successful compromise can give an intruder a foothold on a machine holding source code, internal repositories, credentials, and access to corporate services. The group is using a familiar social engineering approach, but its developer focus raises the stakes.

Hackers Use Fake LinkedIn Job Offers

The attack begins with a convincing recruiter account and an invitation to complete a technical assessment. One observed archive, Front-Technical-Challenge.zip, presented an Express, React, and Vite project named TaskFlow, alongside a README that directed candidates to fix frontend defects.

The instructions claimed server.js was safe and should not be changed. Its first line instead imported colorized_terminal version 2.1.0, a malicious package bundled inside node_modules rather than obtained from npm; loading it launched NodeRabbit from a hidden cache path.

The lure gave recipients three hours to respond and told them not to use AI assistants, adding pressure that discourages careful review.

This mirrors earlier fake job interview challenge attacks, where a normal-looking assessment becomes the delivery mechanism instead of a suspicious executable.

A separate React-based challenge, RankChallenge-react, carried PollCat and displayed an attacker-controlled one-time-password screen.

The malware could register with command-and-control infrastructure and start polling for instructions while the application loaded, even if the candidate never authenticated.

Developer Tools Become Persistence Paths

NodeRabbit gathers host and network details, lists processes, runs shell commands, and manipulates files.

Newer versions check for analysis environments, understand enterprise proxy settings, and can switch their active command servers, making the malware more resilient inside corporate networks.

Its third variant expands to 23 commands and searches for Outlook addresses, mounted drives, development projects, and Git repositories.

It can create a malicious Visual Studio Code extension disguised as GitHub Copilot Helper, then try to start the payload after the editor opens.

The malware can also insert a launcher into Git post-merge or post-checkout hooks, so ordinary repository activity may restart it.

That use of trusted workflows resembles risks highlighted in binding.gyp supply chain attacks, where overlooked project files can trigger harmful code.

PollCat provides file transfers, system inventory, hidden process execution, shell access, and arbitrary JavaScript execution.

It establishes persistence through scheduled tasks on Windows, cron entries on Linux, and cron or LaunchAgent mechanisms on macOS, while checking for traces of security products.

Developers should independently verify recruiters and job openings through official company channels before opening a test.

They should review every dependency and hidden project file, avoid running unsolicited code on a primary workstation, and use an isolated environment for legitimate assessments.

Security teams should monitor developer endpoints for unusual Node.js activity, newly created editor extensions, and unexpected Git-hook changes.

Reviewing suspicious dependency trees and restricting access to source repositories can help reduce exposure, particularly as malicious npm packages target developers through familiar tools.

The campaign shows that a recruitment message can be a supply-chain style entry point, not merely a phishing attempt.

Careful code review, identity checks, and separation between interview tasks and corporate systems give developers a better chance to stop these attacks before a RAT gains a foothold.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7	NodeRabbit-related sample identified by PolySwarm
SHA-256	307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00	NodeRabbit-related sample identified by PolySwarm

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.