Entrar
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware.
Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were sent. Kaspersky’s research documented two previously undocumented malware families from the APT group, delivered through fake coding challenges sent to job seekers on LinkedIn.
The setup is almost embarrassingly simple once you see it laid out. A fake recruiter contacts a software engineer, offers a role, and sends a coding assessment hosted on a completely legitimate-looking Amazon S3 link, the kind of hosting nobody would think twice about.
“During recent threat research, we detected suspicious activity on a system in Afghanistan. We traced it to an archive containing a software development project that the user may have received during a job application process.” reads the report published by Kaspersky. “The archive purported to contain a coding challenge for candidates applying for an engineering role.”
The archive includes a README with a three-hour time limit and an explicit rule against using AI assistants, which sounds like a normal anti-cheating measure until you realize what it’s actually preventing.
Kaspersky spells out exactly why that rule exists.
“The README also imposed a three-hour time limit and prohibited the use of AI assistants.”states the report. “Notably, an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized.”
the researchers write, which means the “no AI” instruction isn’t about fairness in a coding test at all, it’s a deliberate move to stop the one tool most likely to catch the malware before it runs.
The first malware family, called NodeRabbit, is written entirely in Node.js and can run on Windows, Linux, and macOS from the same codebase. That’s a change for Mirage Kitten, which has traditionally used malware written in C, C++ and Go.
NodeRabbit is hidden inside a fake npm package included in the coding test rather than published online. Once the victim runs it, the malware starts a background process and connects to infrastructure hosted on Azure, using AES-256-GCM encryption to protect its communications.
Newer versions added checks to detect sandboxes and analysis environments. The malware looks at system memory, the number of CPU cores and how long the machine has been running before deciding whether to continue.
One sample found in Egypt takes that trick a step further. When NodeRabbit suspects it’s being analyzed, it first sends a few harmless requests to Google, Microsoft and Cloudflare, then stops without contacting its real command server. That helps its traffic look like normal background activity instead of an obvious connection to the attackers.
A third variant, found on a system in Ethiopia, expanded the malware’s command set from 11 to 23 and added something genuinely unusual: the ability to plant a fake VS Code extension disguised as “GitHub Copilot Helper,” complete with a stolen publisher name to look legitimate, plus a technique that quietly injects a malicious launcher into a Git repository’s hooks so the malware relaunches every time someone merges or checks out code.
The second malware family, PollCat, takes a stranger route to establish itself. It’s disguised as a React coding challenge that requires entering a six-digit access code supposedly provided by the recruiter, with a ticking countdown designed to pressure the victim into working fast without scrutinizing anything.
“While tracking NodeRabbit infections, we discovered another malicious tool we dubbed PollCat, which is also distributed under the guise of a programming challenge. The sample we obtained resides inside RankChallenge-react, a React code-fixing challenge presented as a time-limited developer assessment. Running the project invokes npm i && node index.js, which starts the local application and attempts to open the challenge in the user’s browser.” states the report. “
What victims don’t realize is that PollCat starts running and begins talking to its command server the moment the application loads, well before anyone types in that access code at all.
Kaspersky linked both malware families to Mirage Kitten with high confidence. Researchers compared PollCat’s network code with an older backdoor called Retrograde, also known as MiniFast, and found that the two use almost the same connection process.
One detail is especially telling: both malware families treat an HTTP 400 error as a successful registration and extract a session token from the response. That unusual behavior is unlikely to appear by chance in two unrelated malware families.
Victims identified so far cluster in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan, consistent with Mirage Kitten’s long-standing focus on the Middle East and Africa. If your organization does any hiring through LinkedIn outreach involving take-home coding assessments, this is worth flagging to your engineering team directly, because the lure here isn’t a suspicious email with bad grammar, it’s a completely normal-looking job opportunity with a legitimate cloud-hosted download link and a plausible-sounding reason not to use the one tool that would have caught it.
“Mirage Kitten’s latest activity marks a notable evolution in the group’s tooling: NodeRabbit and PollCat are the group’s first Node.js/JavaScript-based implants, departing from its usual native malware deployed through DLL search-order hijacking.” concludes the report.
“The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyberespionage purposes. We continue to track the group’s activity and will report on new developments in future publications.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Mirage Kitten)
