Fake LinkedIn Job Offers Infect Developers With New RATs

Key Takeaways

• An Iran-linked threat group, Mirage Kitten (UNC1549), is leveraging fake LinkedIn job offers to target software developers.
• The attackers trick developers into running seemingly benign coding challenges that secretly deploy new cross-platform Remote Access Trojans (RATs) named NodeRabbit and PollCat.
• These RATs are designed to compromise developer workstations across Windows, Linux, and macOS, potentially granting attackers access to source code, internal repositories, and corporate credentials.
• The campaign has impacted organizations in the fintech, aviation, and aerospace sectors across multiple countries, including Egypt, Ethiopia, and Afghanistan.
• No direct patch is available, as this is a social engineering attack; mitigation relies on vigilance, secure development practices, and robust endpoint monitoring.

Sophisticated Job Offer Scams Deploy New RATs on Developers

Cybersecurity researchers have uncovered a new campaign targeting software developers through fraudulent job offers, turning technical assessments into a stealthy vector for sophisticated remote access malware. This operation, attributed to the Iran-linked threat actor known as Mirage Kitten (also identified as UNC1549), leverages trusted employment platforms like LinkedIn to ensnare unsuspecting professionals.

The core of the attack lies in convincing developers to execute what appears to be a standard coding challenge. However, these seemingly innocuous projects are embedded with malicious code designed to deploy two recently documented cross-platform Remote Access Trojans (RATs): NodeRabbit and PollCat. These RATs are capable of operating on Windows, Linux, and macOS, posing a significant risk to valuable developer workstations.

According to a PolySwarm report, the campaign has already affected organizations within the fintech, aviation, and aerospace sectors. While specific victims have been identified in Egypt, Ethiopia, and Afghanistan, the broader submission of malicious archives suggests a more widespread impact. The danger is amplified by the nature of development work, where routinely downloading, inspecting, and running unfamiliar code is a common practice during hiring processes. A successful compromise can provide attackers with a critical foothold on systems containing sensitive data such as source code, internal repositories, credentials, and access to vital corporate services. This campaign represents a significant escalation in social engineering tactics, specifically tailored to exploit developer workflows.

Hackers Use Fake LinkedIn Job Offers

The attack chain commences with a highly convincing recruiter profile on professional networking sites, followed by an invitation to complete a technical assessment. One analyzed archive, “Front-Technical-Challenge.zip,” contained a legitimate-looking Express, React, and Vite project named “TaskFlow.” The accompanying README file instructed candidates to address front-end defects, appearing as a standard development task.

However, buried within the project’s “server.js” file, which the instructions explicitly stated should remain untouched, was a critical malicious import. The first line of this file pulled in “colorized_terminal” version 2.1.0, a rogue package bundled locally within `node_modules` instead of being fetched from a public npm registry. Loading this package surreptitiously launched the NodeRabbit RAT from a hidden cache directory.

The attackers further pressure victims by imposing tight deadlines, such as a three-hour response window, and explicitly forbidding the use of AI assistants. This tactic is designed to discourage thorough code review, mirroring previous fake job interview challenges where the assessment itself, rather than a suspicious executable, served as the primary delivery mechanism.

Another variant of the attack involved a React-based challenge, “RankChallenge-react,” which deployed the PollCat RAT. This project presented an attacker-controlled one-time-password (OTP) screen. Critically, the malware would register with its command-and-control (C2) infrastructure and begin polling for instructions as soon as the application loaded, regardless of whether the candidate successfully authenticated.

Developer Tools Become Persistence Paths

The deployed RATs, NodeRabbit and PollCat, possess extensive capabilities for reconnaissance, control, and persistence.

NodeRabbit Capabilities

NodeRabbit is designed to extract host and network details, enumerate running processes, execute arbitrary shell commands, and manipulate files on the compromised system. Newer iterations of NodeRabbit incorporate advanced features, including checks for analysis environments, the ability to detect and utilize enterprise proxy settings, and dynamic command server switching, enhancing its resilience within corporate networks.

The third variant of NodeRabbit expands its command set to 23 distinct operations. It actively searches for Outlook addresses, mounted drives, development projects, and Git repositories. This version can also establish persistence by creating a malicious Visual Studio Code extension disguised as “GitHub Copilot Helper,” attempting to launch its payload once the editor is opened.

Furthermore, NodeRabbit can inject a launcher into Git post-merge or post-checkout hooks. This means that routine Git repository activities could inadvertently reactivate the malware, a technique reminiscent of supply chain attacks like those involving `binding.gyp` files, where seemingly innocuous project configurations can trigger malicious code.

PollCat Capabilities

PollCat offers a comprehensive suite of remote access functionalities, including file transfers, system inventory collection, hidden process execution, shell access, and arbitrary JavaScript execution. To maintain persistence, PollCat leverages operating system-specific mechanisms: scheduled tasks on Windows, cron entries on Linux, and either cron or LaunchAgent mechanisms on macOS. It also includes checks to detect and potentially evade security products.

What You Should Do

• Verify Recruiters and Job Offers: Always independently verify the legitimacy of recruiters and job openings through official company channels before engaging or opening any provided materials.
• Scrutinize Code and Dependencies: Thoroughly review every dependency and hidden project file within any coding challenge. Assume all unsolicited code is malicious until proven otherwise.
• Isolate Development Environments: Avoid running unfamiliar or untrusted code on your primary workstation. Utilize isolated virtual machines or sandboxed environments for all legitimate coding assessments.
• Monitor Developer Endpoints: Security teams should implement robust monitoring for unusual Node.js activity, newly created editor extensions (especially for VS Code), and unexpected changes to Git hooks.
• Review Dependency Trees: Regularly audit and review suspicious dependency trees within development projects. Implement strict policies for dependency management.
• Restrict Repository Access: Limit access to source code repositories and sensitive corporate services on developer machines, adhering to the principle of least privilege.
• Educate Developers: Conduct regular training on social engineering tactics, particularly those targeting developers, emphasizing the risks of sophisticated phishing and supply chain attacks via recruitment.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.