What happened
On 1 September 2026, Kaspersky disclosed a Mirage Kitten campaign using fake recruiter approaches and trojanised coding assessments. Targets included software engineers and technology specialists working in aviation, financial technology and related sectors. Conversations began through LinkedIn and other job platforms before candidates received apparently legitimate programming assignments hosted using trusted cloud services.
NodeRabbit and PollCat are cross-platform remote-access malware families written with Node.js or JavaScript and delivered through coding challenge archives. Kaspersky said NodeRabbit was first found on a system in Afghanistan, with later variants identified in Egypt and Ethiopia. The reporting also described malware detections in additional countries, showing that the technical footprint was not confined to one national environment.
One observed NodeRabbit path used a trojanised npm package named colorized_terminal version 2.1.0 imported at the first line of server.js. PollCat was delivered through RankChallenge-react-6uJSX3-main.zip in a timed programming challenge. Kaspersky said persistence could use fake workspace extensions alongside Microsoft Visual Studio Code or modifications to local repositories that trigger execution when code is saved or merged.
Kaspersky’s press release did not publish cryptographic hashes, exact recruiter accounts or complete infrastructure values. Attribution posture: Kaspersky attributes the campaign to Mirage Kitten, an Iran-linked group also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore. The attribution is vendor-assessed and independently reported, but the cited sources do not name victim organisations.
Why this matters now
The campaign bypasses conventional corporate-email assumptions by approaching individuals through professional networking and job-search platforms. The lure is tailored to developer behaviour: downloading dependencies, opening source trees and executing unfamiliar projects are normal parts of technical assessments. Security controls that rely only on obviously malicious documents or macros may not recognise a functional application containing hidden execution.
Developers often hold source-code access, package-registry credentials, cloud tokens, signing permissions and administrative rights. A remote-access implant on a developer workstation can therefore create identity, intellectual-property and software-trust consequences beyond the initial endpoint. The cross-platform design also weakens programmes that monitor Windows comprehensively but leave Linux or macOS engineering devices with reduced telemetry.
The reported persistence techniques deserve specific attention. A malicious workspace extension or repository modification that triggers when code is saved or merged can survive beyond the original archive and appear to be ordinary development activity. Incident scoping must examine developer tooling, repositories and credentials rather than treating removal of the downloaded challenge as complete remediation.
The decision for security leaders
Extend recruitment-fraud controls beyond corporate email. Security, human resources and developer-experience teams should define a verification path for recruiter identities, assessment domains, archives and dependency installation before candidates execute code on managed devices.
Treat execution of a suspicious project as a privileged endpoint incident. Scope cloud and package-registry tokens, source repositories, SSH material, signing access, browser sessions and local credentials that were available to the developer account during the exposure window.
Require engineering controls that identify new workspace extensions, repository execution hooks and dependency changes. A clean antivirus result or deletion of the original archive does not demonstrate that persistence, copied secrets or altered code have been removed.
Evidence of closure
- Endpoint hunt results cover Windows, Linux and macOS developer devices.
- Every suspicious assessment archive has a documented benign or malicious disposition.
- Credential records prove rotation of secrets accessible from confirmed affected endpoints.
- Repository review confirms no unauthorised extensions, hooks or execution-triggering modifications remain.
The Security.io assessment
The material change is the publication of two named cross-platform malware families and developer-specific persistence methods, not the general existence of fake job lures. These details enable focused hunting and justify immediate communication to high-access engineering populations.
The campaign is targeted rather than evidence of indiscriminate compromise across all developers. Organisations should prioritise employees in named sectors, staff undertaking external interviews and engineers with access to production cloud, source-code or signing systems.
The absence of complete hashes and infrastructure values limits deterministic hunting. Defenders should combine the published filenames and package version with behavioural review of unexpected Node.js execution, new workspace extensions, repository changes and unusual use of developer credentials.
Questions for the morning meeting
- Can developers verify recruiter identities and assessment files through an independent channel?
- Do endpoint controls cover developer tooling consistently across Windows, Linux and macOS?
- Which developer secrets require rotation after execution of an untrusted project?
- Can corporate repositories detect unauthorised extensions or execution triggers?