Fake Coding Challenges Turn Developer Recruitment Into a Cross-Platform Malware Trap

Description

A sophisticated recruitment-themed malware campaign is targeting software developers through fake coding assessments.

Threat actors create convincing recruiter personas on LinkedIn and other employment platforms before sending candidates programming challenges that appear to be legitimate take-home assignments. Instead of containing only application code, the projects include malicious components that execute when the developer installs or runs the assessment.

Security researchers identified two previously undocumented malware families, NodeRabbit and PollCat, associated with the activity. The campaign has been linked to the Iran-aligned Mirage Kitten threat group, also known by other tracking names including UNC1549, Smoke Sandstorm, and Nimbus Manticore.

Technical Description

The campaign abuses normal developer behavior.

Victims receive a coding challenge, often hosted through cloud storage, and are encouraged to download and execute the project under the impression that it is required for the recruitment process.

One observed challenge, TaskFlow, was presented as a frontend bug-fixing exercise. Its README included a short completion deadline and instructions designed to discourage candidates from modifying specific files. The malicious logic was instead embedded within the supplied project dependencies.

The challenge imported a trojanized colorized_terminal package from the bundled node_modules directory. The package launched NodeRabbit as a background process without requiring the victim to knowingly execute a separate malware file.

A second assessment, RankChallenge-react, was used to distribute PollCat through a React-based coding exercise.

Attack Overview

The observed attack chain can be summarized as:

Fake Recruiter → Job Offer → Coding Assessment → Malicious Project Download → Dependency Execution → RAT Deployment → Persistence → Remote Command Execution → Data Collection

Attackers intentionally make the coding assignment appear time-sensitive. One PollCat assessment required candidates to complete the challenge within approximately one hour and enter a recruiter-provided one-time code, creating additional pressure to execute the project quickly.

The technique is particularly effective against developers because running unfamiliar repositories, installing dependencies, and executing development servers are routine parts of their work.

Technical Analysis

NodeRabbit

NodeRabbit is a cross-platform remote-access trojan developed using Node.js/JavaScript.

The malware can:

• Collect system information
• Communicate with attacker-controlled infrastructure
• Execute commands
• Enumerate processes
• Browse files
• Transfer files
• Search developer project directories
• Modify files
• Establish persistence through development-related mechanisms

Later versions can add a fake editor extension and modify Git hooks, allowing the malware to survive or reactivate through normal developer activity.

PollCat

PollCat is another cross-platform RAT distributed through a malicious React coding assessment.

It can:

• Execute shell commands
• Collect host information
• Move or delete files
• Transfer files
• Receive additional payloads
• Maintain persistence

Persistence mechanisms vary by operating system, including scheduled tasks on Windows, cron jobs on Linux, and LaunchAgents on macOS.

Abuse of Developer Trust

The campaign does not depend solely on malware sophistication.

The attackers first establish credibility through professional-looking recruitment interactions. Once the victim believes the assessment is legitimate, normal developer actions such as npm dependency installation and running a development server trigger the malicious components.

This makes traditional phishing awareness less effective because the malicious activity occurs inside an apparently legitimate software-development workflow.

IOC

• CBAAF0900A13F28E380F49ADECEC932C
• 1EA83E4E4592B01E4ACAB63EB867BEE5
• 366515822D5AC1CC500711EF57A2E32E
• CF449F1992C2819E62AC44A0B06AC2E7
• E95A4366686E3F786EA3C056FAB5B0DA
• DE5AF16A3757EF700B01DC34D67079AE
• BE086789568441D0D7E4679AEE51F566
• E259C5EDF158AAC4CFE14F77DDD0B196
• 291AC3ABE73C5158E59A437B75D5F0AA
• 0962F56D7EC69F4F2A0162DCBE22116B
• 795E053A990A1569FFDCB57F48F6D085
• 810F8E3B88EB05F710C09552941D6F56

• oracle-challenge.s3[.]us-east-1.amazonaws[.]com
• naturalapplication.azurewebsites[.]net
• retaildemo.azurewebsites[.]net
• tubitak.azurewebsites[.]net
• rgbteller.azurewebsites[.]net
• wslwebui.azurewebsites[.]net
• plugplay.azurewebsites[.]net
• crossdwm.azurewebsites[.]net
• wdisystem.azurewebsites[.]net
• wslmenus.azurewebsites[.]net
• dnshnsdev.azurewebsites[.]net
• hpjumpsrv.azurewebsites[.]net
• storview.azurewebsites[.]net
• lifespotify[.]com
• gamebarapp.azurewebsites[.]net
• gamebarappinformation.azurewebsites[.]net
• sahi-finance[.]com

Potential Impact

Successful infection could result in:

• Developer workstation compromise
• Remote command execution
• Source-code theft
• Credential theft
• Exposure of .env files and secrets
• Cloud credential compromise
• Git repository compromise
• Theft of intellectual property
• Persistent access to development systems
• Lateral movement into corporate environments
• Potential software supply-chain compromise

The cross-platform nature of NodeRabbit and PollCat increases the risk because organizations cannot rely solely on Windows-focused controls.

Recommendations

Immediate Actions

1. Investigate suspicious coding-test archives downloaded from recruiters.
2. Search endpoints for the listed MD5 hashes.
3. Block or investigate communication with the listed C2 infrastructure.
4. Review recently executed Node.js and JavaScript projects.
5. Inspect unexpected node_modules packages and project dependencies.
6. Check for unauthorized Git hooks and editor extensions.
7. Investigate unexpected scheduled tasks, cron jobs, and LaunchAgents.
8. Rotate credentials stored on systems that executed suspicious coding challenges.
9. Review GitHub, cloud, SSH, API-token, and .env credentials for potential exposure.
10. Isolate compromised developer systems before performing credential rotation.

Preventive Actions

1. Treat unsolicited coding assessments as untrusted software.
2. Verify recruiter identities through the company's official recruitment channel.
3. Execute unknown coding challenges only inside isolated VMs or sandbox environments.
4. Never run recruitment projects on systems containing production credentials.
5. Inspect package.json, lock files, and node_modules before execution.
6. Implement endpoint controls for suspicious Node.js child processes and network activity.
7. Monitor Git hooks and developer-tool configuration changes.
8. Use secret-management solutions instead of storing credentials in .env files.
9. Apply least privilege to developer workstations and source-code repositories.
10. Monitor unusual outbound connections from development environments.

Conclusion

The Mirage Kitten campaign demonstrates how threat actors can transform a normal recruitment workflow into a highly effective malware-delivery mechanism. By combining convincing recruiter personas, time-sensitive coding assessments, malicious Node.js dependencies, and cross-platform RATs, attackers can gain persistent access to developer systems without relying on conventional phishing attachments.

Organizations should treat externally supplied coding projects as potentially untrusted code and provide developers with isolated environments for technical assessments. Strong endpoint monitoring, dependency inspection, Git security, and credential protection are essential to prevent a fake job opportunity from becoming an entry point into the enterprise.