Iran-Linked APT Mirage Kitten Spreads Malware Via Fake Coding Tests
NodeRabbit and PollCat target job seekers through sophisticated LinkedIn traps.
1Fake Job Offers as Attack Vector
Mirage Kitten sends fake job offers to software engineers on LinkedIn. According to Kaspersky's report, victims receive 'coding assessments' hosted on Amazon S3. The tests include a rule prohibiting AI assistants—specifically designed to block the one tool that could detect the malicious code. This social engineering tactic demonstrates advanced understanding of developer workflows.
2Technical Breakdown of NodeRabbit
The Node.js-based NodeRabbit malware operates across Windows, Linux and macOS. This shift from traditional C/C++ to JavaScript marks a tactical evolution. The malware connects to Azure infrastructure using AES-256-GCM encryption. Newer versions perform environment checks—analyzing system memory, CPU cores, and uptime to evade analysis. An Egyptian variant sends decoy requests to Google when it detects sandboxing.
3PollCat's Psychological Manipulation
Disguised as a React coding challenge, PollCat pressures victims with a ticking countdown and fake 6-digit access code. The malware initiates C2 communication immediately upon loading—before any code entry. Kaspersky established connection between PollCat and Mirage Kitten by matching network code with the Retrograde backdoor. Both treat HTTP 400 errors as successful registrations—a rare behavioral fingerprint.
4Targeted Industries and Geography
Employees in fintech and aviation sectors face highest risk. Victims cluster in Egypt, Ethiopia and Afghanistan, aligning with the group's Middle East/Africa focus. Kaspersky warns companies using take-home coding tests: The threat arrives via legitimate-looking job opportunities, not suspicious emails. The use of cloud-hosted downloads makes detection particularly challenging.
5VS Code Extension Threat
A NodeRabbit variant found in Ethiopia deploys a fake VS Code extension masquerading as 'GitHub Copilot Helper'. Using a stolen publisher name for legitimacy, it injects a malicious launcher into Git hooks. This ensures reactivation during every merge or checkout—a persistent attack mechanism that bypasses traditional endpoint security scans.
6APT Group's Tactical Shift
Mirage Kitten's transition from DLL hijacking to Node.js implants represents significant capability evolution. JavaScript's cross-platform nature expands potential victim pool. Researchers note this reflects broader APT trend toward weaponizing common developer tools. The group's understanding of CI/CD pipelines (via Git hooks) demonstrates alarming operational maturity.
7Critical Defense Recommendations
Companies using cloud-based coding tests must immediately educate engineering teams. Assessments banning AI tools should raise red flags. Kaspersky advises rigorous checks for unknown npm packages—especially first-line imports. Network monitoring for unexpected Azure/AWS connections from development environments is equally crucial.
8Wake-Up Call for Tech Hiring
This campaign exposes security gaps in technical recruitment pipelines. LinkedIn's transformation into an APT attack vector demands platform-level countermeasures. The rise of cross-platform JavaScript malware—capable of bypassing traditional OS-specific defenses—will likely dominate 2024 threat landscapes. The incident underscores need for secure coding environment standards across industries.