Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked cyberespionage group Mirage Kitten is targeting software engineers with fake recruiter outreach on LinkedIn and job-search platforms.

Using trojanized coding assessments to deploy two previously undocumented cross-platform remote access trojans: NodeRabbit and PollCat.

The campaign targets developer workstations across Windows, Linux, and macOS, with victims identified in aviation, aerospace, and fintech organizations in Egypt, Ethiopia, and Afghanistan.

Kaspersky researchers discovered the activity after identifying an initial NodeRabbit infection in Afghanistan, then uncovering more advanced variants in Egypt and Ethiopia.

The attack begins with fake recruiter personas that offer software engineering roles and direct candidates to complete a technical exercise.

One lure, named Front-Technical-Challenge.zip, contained a seemingly legitimate Express, React, and Vite application called TaskFlow.

Its README instructed the recipient to repair frontend bugs, explicitly claiming that server.js was safe and should not be changed.

That instruction was part of the deception. The first line of server.js imported colorized_terminal version 2.1.0, a malicious package placed directly in the archive’s bundled node_modules directory rather than published to the npm registry.

When executed, the package silently launched NodeRabbit from a hidden cache path as a detached background process. Later samples used another trojanized dependency, pretty-log, to trigger the implant.

The lures imposed three-hour deadlines and told candidates not to use AI assistants, creating urgency while discouraging code review.

The tactic exploits a normal developer workflow: downloading unfamiliar source code, installing dependencies, and running an application locally.

NodeRabbit is a Node.js RAT that collects host details, enumerates processes and network interfaces, runs shell commands, reads and writes files, creates directories, and executes attacker-supplied JavaScript.

It generates a host identifier from information including the hostname, username, operating-system version, architecture, and MAC address, then communicates with Azure-hosted command-and-control infrastructure using AES-256-GCM-protected requests.

The more advanced variants add anti-analysis checks, including tests for limited memory, low CPU counts, short uptime, analysis-tool processes, and suspicious usernames or hostnames.

Polyswarm Researchers said that, the operation marks Mirage Kitten’s first publicly documented use of Node.js- and JavaScript-based malware, a shift from the group’s prior reliance on native C, C++, and Go tooling often delivered through DLL search-order hijacking.

Fake LinkedIn Job Offers

If those conditions are detected, NodeRabbit sends benign-looking HEAD requests to Google, Microsoft, and Cloudflare before exiting without contacting its C2 server.

It also supports enterprise proxy discovery and HTTP CONNECT tunneling, including Basic, NTLM, and Negotiate authentication paths.

Most notably, NodeRabbit’s third variant abuses trusted development workflows for persistence. It can install a rogue Visual Studio Code extension masquerading as “GitHub Copilot Helper,” configured to activate after VS Code starts.

The malware can also scan common development directories and recent VS Code workspaces for Git repositories, then append a launcher to post-merge and post-checkout hooks. A normal Git operation can subsequently relaunch the RAT.

PollCat, a separate obfuscated JavaScript RAT, arrived in a React-based coding challenge called RankChallenge-react.

The project included a one-time-password system designed to make the assessment appear exclusive and time-sensitive.

However, the malware starts during application initialization before the target enters an OTP meaning failed authentication does not stop the implant from registering with its C2 infrastructure and polling for commands.

PollCat supports file transfer, directory and drive enumeration, process control, shell execution, ZIP operations, hidden process creation, Windows DLL execution, and arbitrary JavaScript execution through its EVAL_JS command.

Its SYSTEM_CHECK capability inventories processes and filesystem locations associated with 24 security and technology vendors, including Microsoft, Cisco, Fortinet, CrowdStrike, SentinelOne, Sophos, ESET, Bitdefender, and Malwarebytes.

Mirage Kitten uses Microsoft Azure Websites alongside Cloudflare-backed and attacker-controlled domains, allowing malicious traffic to blend into routine cloud-service communications.

Kaspersky found that the operators sometimes incorporated a targeted organization’s name into Azure subdomains, potentially making outbound C2 traffic appear more legitimate in enterprise logs.

The researchers linked roughly 11 additional infrastructure assets to the activity.

Also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore, Mirage Kitten has historically focused on strategically important organizations across the Middle East and Africa.

Its latest operation shows that developer environments have become a high-value intrusion surface: a compromised engineer may provide access to source repositories, build pipelines, credentials, cloud resources, and internal systems.

Organizations should treat unsolicited coding assessments as potentially hostile, scan project archives before execution, inspect bundled dependencies and lockfiles, restrict unreviewed VS Code extensions, and monitor Git-hook modifications across developer endpoints.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.