Software developers looking for their next job are being targeted by a campaign that turns a routine take-home coding test into a remote-access trojan installer. Researchers attribute the operation to Mirage Kitten, an Iran-linked group also tracked as UNC1549, which is using fake recruiter profiles on LinkedIn and other employment platforms to deliver two newly documented pieces of cross-platform malware called NodeRabbit and PollCat.

A Coding Challenge That Comes With a Catch

The attack begins with what looks like an ordinary hiring process: a convincing recruiter account reaches out and invites the target to complete a technical assessment. In one documented case, victims received an archive called Front-Technical-Challenge.zip containing what appeared to be a standard Express, React, and Vite web project named “TaskFlow,” complete with a README instructing candidates to fix a handful of frontend bugs. The instructions specifically told candidates that a file called server.js was safe and should not be modified.

That reassurance was the trap. The file’s very first line quietly imported a malicious package bundled directly inside the project’s node_modules folder — rather than fetched from the real npm registry — which then launched the NodeRabbit trojan from a hidden cache location the moment the project was run. Adding pressure to discourage careful review, the fake recruiters reportedly gave candidates only three hours to complete the challenge and explicitly told them not to use AI coding assistants, a detail that conveniently also prevents an AI tool from flagging the malicious code.

A second variant of the lure, a React-based project called RankChallenge-react, delivered a different trojan called PollCat and displayed a fake one-time-password verification screen. Notably, the malware began registering with its command-and-control infrastructure and polling for instructions as soon as the application loaded — even if the candidate never actually entered anything into the fake verification screen.

Malware Built to Live Inside a Developer’s Workflow

NodeRabbit is capable of collecting host and network information, listing running processes, executing shell commands, and manipulating files on disk. Newer versions actively check whether they’re running inside a malware analysis environment, detect enterprise proxy configurations, and can switch which command-and-control server they report to, making the malware considerably more resilient once it lands inside a corporate network. The most advanced variant researchers found supports 23 distinct commands and specifically searches infected machines for Outlook data, mounted drives, development projects, and Git repositories.

Perhaps most concerning for security teams, NodeRabbit can create a malicious Visual Studio Code extension disguised as a “GitHub Copilot Helper” and attempt to auto-launch its payload the next time the code editor opens. It can also plant a launcher inside Git’s post-merge or post-checkout hooks, meaning something as routine as pulling the latest code or switching branches could silently restart the infection.

PollCat, the second trojan, offers file transfer capability, system inventory collection, hidden process execution, remote shell access, and the ability to run arbitrary JavaScript on the infected machine. It establishes persistence differently depending on the operating system — scheduled tasks on Windows, cron jobs on Linux, and cron or LaunchAgent configurations on macOS — while also checking the system for signs of installed security products.

Why Developer Endpoints Are an Especially Valuable Target

The campaign has reportedly affected organizations in the fintech, aviation, and aerospace sectors, with confirmed victims located in Egypt, Ethiopia, and Afghanistan, though the submission of malicious archives to threat-sharing platforms suggests the true scope of exposure could be broader. The choice of target makes sense from an attacker’s perspective: developer workstations routinely hold source code, credentials, internal repository access, and connections to corporate infrastructure that would otherwise take an attacker considerable effort to obtain through other means.

How Developers and Security Teams Can Respond

Because this campaign essentially weaponizes the hiring process itself, defending against it requires a mix of individual vigilance and organizational controls:

• Independently verify recruiters and job postings through a company’s official careers page or contacts before opening any provided test materials.
• Review every dependency and hidden project file in a take-home assignment rather than trusting instructions that say a particular file is “safe” and shouldn’t be touched.
• Complete coding assessments inside an isolated virtual machine or sandboxed environment rather than on a primary development workstation.
• Security teams should monitor developer endpoints for unusual Node.js activity, unexpected new code-editor extensions, and unauthorized changes to Git hooks.

The campaign is a reminder that recruitment messages can now function as a supply-chain-style entry point rather than a simple phishing attempt, and that the same scrutiny developers apply to unfamiliar third-party packages deserves to be applied to unsolicited “job opportunity” code as well.