Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.
- Fake recruiter personas deliver Front-Technical-Challenge.zip and RankChallenge-react tests with three-hour deadlines.
- Malicious packages ship inside bundled node_modules, not the npm registry, evading registry trust.
- NodeRabbit variant masquerades as GitHub Copilot Helper extension and abuses Git hooks for persistence.
- PollCat checks for 24 security vendors including CrowdStrike, SentinelOne, Fortinet and Microsoft.
- First documented shift from Mirage Kitten's native C, C++ and Go tooling to Node.js.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1195.002 Compromise Software Supply ChainT1059.007 JavaScript/JScriptT1546.018 Event Triggered Execution: Git HooksT1071.001 Web Protocols
- Threat actors
- Mirage KittenUNC1549Smoke SandstormNimbus Manticore
- Malware
- NodeRabbitPollCat
- Organizations
- KasperskyMicrosoftGoogleCloudflare
- Countries
- EgyptEthiopiaAfghanistanIran
From the original article
3 min read at gbhackers.com
Iran-linked cyberespionage group Mirage Kitten is targeting software engineers with fake recruiter outreach on LinkedIn and job-search platforms. Using trojanized coding assessments to deploy two previously undocumented cross-platform remote access trojans: NodeRabbit and PollCat.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.