Cybersecurity researchers have uncovered a targeted campaign in which hackers use fake software engineering tests to infect developers with previously undocumented remote access trojans (RATs).
The activity has been attributed with high confidence to Mirage Kitten, an advanced persistent threat (APT) group known for targeting organizations in the Middle East and Africa.
The campaign abuses legitimate job-search platforms, including LinkedIn, to contact software engineers through fake recruiter profiles.
Victims are then directed to download coding challenges hosted on legitimate cloud infrastructure such as Amazon S3. The projects appear to be normal programming assessments but contain hidden malicious components.
Researchers identified two malware families, NodeRabbit and PollCat. Both are cross-platform RATs designed to run on Windows, Linux and macOS.
Their use marks a significant change in Mirage Kitten’s tooling, which historically relied on native malware written in languages such as C, C++ and Go.
Fake Coding Tests Deliver Backdoors
The infection begins when a developer receives a technical assessment archive as part of a supposed recruitment process. One sample, Front-Technical-Challenge.zip, contained a TaskFlow application built with Express, React and Vite.
The project’s server.js file secretly imported a malicious npm package named colorized_terminal version 2.1.0.
Instead of being downloaded from npm, the package was bundled inside the archive. When loaded, it launched NodeRabbit from a hidden directory under node_modules.
NodeRabbit collects host information, including the hostname, username, operating system and MAC address, to generate a unique agent identifier.
It then establishes persistence according to the operating system. Windows variants use Registry Run keys or scheduled tasks, while Linux samples use cron jobs and macOS versions use LaunchAgents.
The malware communicates with Azure-hosted command-and-control (C2) infrastructure. Its traffic is protected using AES-256-GCM encryption.
The RAT can collect system information, list processes, execute shell commands, read and modify files, create directories and run JavaScript supplied by the attacker.
Researchers identified several NodeRabbit variants, including more advanced versions capable of detecting analysis environments and supporting corporate proxy configurations.
The second malware family, PollCat, was hidden inside a React-based coding challenge called RankChallenge-react.
Its startup components automatically loaded the malicious RAT, meaning infection could begin before the victim completed the fake challenge’s OTP authentication.
PollCat supports numerous commands for file operations, process management, command execution, JavaScript execution, system discovery and file transfer.
It also searches developer environments and security software directories for valuable information, securelist said. A particularly notable feature is its ability to establish persistence through developer workflows.
One NodeRabbit variant can create a fake Visual Studio Code extension named GitHub Copilot Helper, designed to resemble an AI coding assistant. Another feature injects launch commands into Git hooks so that normal repository operations can trigger the malware.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
.webp?fit=1068,580&ssl=1&description=Cybersecurity researchers have uncovered a targeted campaign in which hackers use fake software engineering tests to infect developer){kind=link}