Security researchers have uncovered a malware campaign targeting software developers through fake job assessments. The attackers pose as recruiters and hide malicious code inside coding challenges. Russian cybersecurity firm Kaspersky attributed the activity to a threat group tracked as Nimbus Manticore, also known as Mirage Kitten and UNC1549.
“Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives,” Kaspersky security researcher Omar Amin said. “Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives.”
The group deployed two previously undocumented malware families named NodeRabbit and PollCat. Both are cross-platform remote access trojans, meaning they can infect Windows, Linux, and macOS systems. This marks a notable shift for the group. It previously relied on malware written in C, C++, and Go, but has now moved to Node.js and JavaScript-based tools.
How the Attack Works
The campaign begins with a fake recruiter reaching out on LinkedIn or other job platforms. According to Kaspersky researcher Omar Amin, operators deliver the malware through spear-phishing messages containing trojanized coding challenge archives. In one documented case, the attacker impersonated a talent acquisition specialist at a major technology company. They then approached a software engineer with a technical assignment.
The archive contained a legitimate-looking project management tool called Taskflow. Candidates were told to find and fix bugs within three hours, and crucially, without using AI-assisted tools. The instructions also asked candidates not to modify one specific server file, claiming it was bug-free. However, that exact file contained the hidden malicious code.
Blending Into Developer Machines
Once triggered, NodeRabbit silently launches in the background. It connects to cloud-hosted command servers and supports 11 commands.
The implant in question is NodeRabbit, which communicates with one of three Azure-hosted command-and-control (C2) addresses (“plugplay.azurewebsites[.]net,” “rgbteller.azurewebsites[.]net,” and “wslwebui.azurewebsites[.]net”) through three distinct API endpoints –
- /api/rabbit/checkin, to register agent and host information
- /api/rabbit/task, to poll for commands
- /api/rabbit/result, to send task results
A second variant that uses a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, while also partially implementing corporate proxy support and terminating if found to be running in an analysis environment
As per Kaspersky, there is even a third variant that’s also launched using the pretty-log npm package but uses a different set of API endpoints to accomplish the same tasks –
- /sdk/v2/ready
- /sdk/v2/config
- /sdk/v2/events
These let attackers gather system details, run shell commands, read files, and map network settings. Kaspersky found the first sample in Afghanistan, with later variants surfacing in Egypt and Ethiopia.
The second malware, PollCat, arrives through a separate coding challenge featuring a fake one-time password screen. Notably, the malware runs regardless of whether the victim enters the code correctly. It supports 22 commands and even scans for folders belonging to 24 security and software vendors.
“Although the visible exercise is not a security CTF, the project uses CTF terminology in several places,” Kaspersky said. “The root package is named ctf-server, the backend prints CTF server running, the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf.”
Who Is Being Targeted
The hacker group Mirage Kitten (which has ties with Iran) has introduced NodeRabbit and PollCat as their first-ever Node.js/JavaScript implants. This marks a departure from their usual approach of using native malware through DLL search-order hijacking.
By embracing cross-platform scripting, the operators now have a unified codebase that works seamlessly on Windows, Linux, and macOS, allowing their payloads to integrate smoothly into developer environments. Despite this evolution in their tools, the delivery method remains true to Mirage Kitten’s established tactics. They continue to leverage recruiter personas on LinkedIn to target key sectors in the Middle East and Africa for cyberespionage.
Because developers often hold cloud credentials and corporate access, their workstations make valuable entry points. This tactic of using recruitment lures mirrors techniques seen from other threat groups globally.
Developers should treat unsolicited coding tests with caution. Running unfamiliar project files inside isolated environments, rather than personal machines, remains a strong defensive measure.
