Fake Coding Tests Impersonate Recruiters to Infect Software Developers

Key Takeaways

• A sophisticated campaign is targeting software developers with fake coding challenges disguised as job interview assessments.
• The attacks deploy two novel, cross-platform remote access tools (RATs), NodeRabbit and PollCat, capable of infecting Windows, Linux, and macOS systems.
• Victims have been identified in the aviation, aerospace, and financial technology sectors across Egypt, Ethiopia, and Afghanistan.
• These attacks leverage social engineering, exploiting developers’ trust in recruitment processes to gain initial access to sensitive systems.
• The malware establishes persistence through various methods, including malicious packages, fake editor extensions, and Git hooks, posing a severe threat to developer workstations and corporate networks.

Hackers Exploit Job Searches to Deploy Cross-Platform Malware on Developer Systems

Cybercriminals are increasingly leveraging the job market to ensnare software developers, transforming seemingly innocuous coding challenges into conduits for malware delivery. This latest campaign introduces two previously unknown cross-platform remote access tools (RATs), dubbed NodeRabbit and PollCat, designed to infiltrate developer environments under the guise of legitimate take-home coding assessments.

The operation has already compromised targets within critical sectors such as aviation, aerospace, and financial technology, with reported victims spanning Egypt, Ethiopia, and Afghanistan. This sophisticated approach highlights a significant vulnerability: the ability for a routine project download to grant attackers a critical foothold on a developer’s workstation, potentially exposing sensitive source code, cloud credentials, and corporate network access.

Mirage Kitten Group Adopts New Tactics

Researchers at Securelist were instrumental in identifying the NodeRabbit and PollCat families while monitoring the activities of the notorious Mirage Kitten group. Securelist said in a report that this marks the first documented instance of the group utilizing Node.js and JavaScript implants. This strategic pivot is significant because these new malware families are designed to operate across Windows, Linux, and macOS environments, effectively mirroring the diverse operating system landscape commonly found within modern engineering teams.

This evolution builds upon established social engineering techniques seen in prior fake recruiter campaigns, but integrates them with more advanced persistence mechanisms and developer-specific exploitation methods.

Infection Vector: The Deceptive Coding Test

The initial phase of the attack begins with a convincing recruiter persona established on platforms like LinkedIn or other professional job-search services. The targeted developer receives an enticing job offer for an engineering role, followed by a link to a coding assessment hosted within an Amazon S3 bucket. Attackers then exert pressure on the candidate to promptly download and execute the project.

One such lure, named “TaskFlow,” was presented as a front-end bug-fixing exercise. Its accompanying README file specified a three-hour time limit, explicitly prohibited the use of AI assistants, and misleadingly asserted the integrity of the `server.js` file. These instructions were meticulously crafted to divert the developer’s attention away from the malicious alterations embedded within the code.

The `server.js` file’s opening line included an import statement for `colorized_terminal` version 2.1.0. This particular package was not sourced from the public npm registry but was maliciously bundled directly within the `node_modules` directory. Its inclusion silently initiated NodeRabbit in the background from a concealed cache path, mirroring the stealthy code execution seen in supply chain attacks like `binding.gyp`. Other compromised archives utilized a second tainted package, `pretty-log`, to deploy more advanced NodeRabbit variants. Forensic analysis uncovered related samples from systems in Afghanistan, Egypt, and Ethiopia, thereby connecting the campaign to a broader offensive targeting organizations across the Middle East and Africa.

NodeRabbit and PollCat: Expanding Footholds

NodeRabbit functions as a robust remote access tool, capable of gathering detailed host information, communicating with command-and-control servers, executing arbitrary commands, enumerating processes, browsing file systems, and facilitating data exfiltration. Later iterations of NodeRabbit also actively scan developer project directories, can install fraudulent editor extensions, and inject launchers into Git hooks. This ensures that routine development activities inadvertently re-activate the malware, maintaining persistent access.

PollCat, another potent RAT, is delivered via a distinct React-based assessment known as “RankChallenge-react.” This project instructs candidates to run an installation command and then presents an expiring, one-time code provided by the “recruiter.” This tactic creates a false sense of urgency while, unbeknownst to the victim, its hidden components establish contact with attacker infrastructure.

Once operational, PollCat can execute shell commands, manipulate files (move or delete), collect system diagnostics, and transfer files between the victim’s machine and the attackers. It achieves persistence through platform-specific mechanisms: scheduled tasks on Windows, cron jobs on Linux, or LaunchAgents on macOS. This method of compromise bears a striking resemblance to the malicious `node-ipc` package incident, where a loaded JavaScript module exposed sensitive developer secrets and enabled remote control.

What You Should Do

• Verify Recruitment Opportunities: Always independently confirm job opportunities and coding challenges through an employer’s official channels (e.g., corporate website, official HR email) before engaging. Do not rely solely on LinkedIn profiles or unsolicited emails.
• Scrutinize Code and Dependencies: Treat all unsolicited code, especially those downloaded for coding tests, as untrusted. Thoroughly inspect all dependencies, `package.json` files, startup scripts, and any unfamiliar code before execution.
• Use Isolated Environments: Perform coding challenges and test new projects in isolated virtual machines or sandboxed environments that contain no production credentials, sensitive data, or private repositories.
• Monitor for Anomalies: Regularly review your system for unexpected scheduled tasks, unusual editor extensions, or altered Git hooks, as these are common persistence mechanisms used by this malware.
• Rotate Credentials: Immediately rotate any credentials (API keys, cloud access keys, personal access tokens) that may have been stored on a machine that ran a suspicious coding challenge.
• Educate and Equip Teams: Employers should recognize recruitment as an attack vector. Provide secure, sanctioned testing environments for candidates and establish clear, easy-to-follow protocols for verifying recruiter identities and assessment legitimacy.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.