Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.
Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.
- Kaspersky attributes two new Node.js implants, NodeRabbit and PollCat, to Iran-linked Mirage Kitten with high confidence.
- Fake LinkedIn recruiters distribute trojanized coding tests on Amazon S3; candidates are told not to use AI assistants.
- NodeRabbit runs on Windows, Linux, and macOS, uses AES-256-GCM-encrypted C2 on Azure, and performs sandbox checks.
- A variant plants a fake 'GitHub Copilot Helper' VS Code extension and injects persistence into Git repository hooks.
- Victims identified so far cluster in fintech and aviation in Egypt, Ethiopia, and Afghanistan.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 Malicious FileT1059.007 JavaScript/JScriptT1573 Encrypted ChannelT1036.005 Match Legitimate Name or Location
- Threat actors
- Mirage Kitten
- Countries
- EgyptEthiopiaAfghanistan
From the original article
4 min read at securityaffairs.com
Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware. Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were sent.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.