Developers are becoming prime targets once again in a deceptive campaign that uses counterfeit job offers to deliver remote access trojans (RATs). Attackers posing as recruiters are handing out mock technical assessments which, when executed, unleash malware on systems running Windows, Linux, or macOS.
How the Operation Works
The ruse starts with professional looking LinkedIn accounts and other hiring platforms, where attackers reach out to developers under the guise of offering roles. These engagements usually involve a coding test packaged as a familiar project—one such example included a React/Vite/Express task named “TaskFlow.” The readme file instructs participants to correct frontend issues while claiming the server.js file is harmless. But server.js secretly imports a compromised package tagged colorized_terminal, executing a RAT dubbed NodeRabbit. In another case, a React-based challenge called RankChallenge-react pushed a different foothold, deploying malware named PollCat even if the user didn’t log in.
Capabilities That Raise the Stakes
NodeRabbit performs a wide range of functions: surveying network and host info, executing shell commands, and manipulating files. Sophisticated variants now detect virtual environments, adapt to corporate proxy settings, and rotate their command-and-control servers to avoid detection. One version stretched to 23 distinct commands, rummaging through Outlook contacts, mounted drives, development directories, and Git repositories. It also disguises itself with a fake Visual Studio Code extension masquerading as a GitHub Copilot Helper, and abuses Git hooks (post-merge or post-checkout) to ensure persistence.
PollCat offers similar menace: file transfers, hidden process execution, arbitrary JavaScript capability, and shell access. For persistence, it relies on scheduled tasks in Windows, cron jobs on Linux, and LaunchAgent or cron on macOS—all while scanning for security tools that might block it.
Where It’s Hitting & What to Watch For
Fintech, aviation, and aerospace organizations in Egypt, Ethiopia, and Afghanistan have been affected, with indications that the operation may be more widespread. The attacker group is tied to Mirage Kitten (also known as UNC1549), believed to be Iran-linked. Developers are especially vulnerable, since hiring tests often require downloading and running unfamiliar code on their main machines.
Security teams should look out for any unusual Node.js behavior, newly installed editor extensions, or modifications to Git hooks. Review all dependencies in project packages, avoid running test code directly on main workstations, and validate recruiter identities via trusted channels. Separating interview coding tasks from corporate systems is crucial.
A list of indicators of compromise includes two SHA-256 hashes linked to NodeRabbit payloads, as well as IPs and domains masked for safety until reviewed in secure threat intelligence platforms.
The overarching takeaway: what seems like a standard job assessment can mask a sophisticated supply chain attack. The developer-oriented vector turns everything from Git hooks to npm packages into potential danger zones.
Why this matters: Attacks through developer workflows could expose source code, credentials, corporate infrastructure, and intellectual property. As organizations build defenses, it’s worth remembering that recruiting is no longer just about headcount—it’s now a possible delivery method for malware.
