Mirage Kitten Targets Developers with Fake Coding Tests Delivering Node.js Malware
The Mirage Kitten group is employing a sophisticated social engineering tactic, posing as recruiters to deliver novel Node.js malware via fake coding tests to software developers.
Cybercriminals are increasingly blurring the lines between legitimate job recruitment and malicious infiltration, with the latest campaign from the Mirage Kitten group specifically targeting software developers. Posing as recruiters on platforms like LinkedIn, the threat actors are sending out seemingly standard coding assessments that, upon execution, deploy two previously undocumented cross-platform remote access tools: NodeRabbit and PollCat. These tools are delivered through trojanized npm packages embedded within what appear to be legitimate assessment projects, designed to exploit the trust developers place in their work environments.
The campaign's effectiveness lies in its meticulous social engineering and technical execution. Developers are pressured to complete these take-home tests quickly, often under a strict time limit and with instructions that discourage the use of AI assistants, steering their attention away from the malicious code hidden within. For instance, one lure named TaskFlow, presented as a frontend bug-fixing exercise, contained a modified server.js file that silently imported a malicious package from the node_modules directory. This allowed NodeRabbit to execute in the background from a hidden cache path, mirroring the risks seen in previous supply chain attacks where normal developer actions trigger code execution.
NodeRabbit and PollCat are designed to provide attackers with significant access and control over compromised developer workstations. NodeRabbit is capable of gathering host details, executing remote commands, listing processes, browsing files, and transferring data. More advanced versions can also locate developer project directories, install fake editor extensions, and inject launchers into Git hooks, ensuring the malware can persist and re-establish itself through routine development activities. This broad functionality makes it a potent tool for espionage and data theft.
PollCat, delivered via a separate React-based assessment called RankChallenge-react, operates with similar stealth and persistence. After a developer runs an installation command and enters a time-sensitive, recruiter-provided code, a hidden component of PollCat begins communicating with attacker-controlled infrastructure. Its capabilities include executing shell commands, manipulating files, collecting system information, and exfiltrating data. PollCat establishes persistence through mechanisms like scheduled tasks on Windows, cron jobs on Linux, and LaunchAgents on macOS, making it difficult to detect and remove.
The geographical scope of this campaign is notable, with researchers identifying victims in the aviation, aerospace, and fintech sectors across Egypt, Ethiopia, and Afghanistan. This suggests a targeted effort to compromise organizations in the Middle East and Africa, potentially for industrial espionage or to gain access to sensitive intellectual property. The use of Node.js and JavaScript implants is also significant, as these tools run on Windows, Linux, and macOS, aligning with the diverse operating system environments common in modern engineering teams.
This campaign highlights a critical evolution in supply chain attacks, moving beyond compromised libraries to weaponizing the very assessment tools used to vet new talent. The researchers emphasize that developers should treat unsolicited assessment archives with extreme caution, even when they come from seemingly credible sources. Verifying opportunities through official company channels, thoroughly inspecting dependencies and startup files, and utilizing isolated development environments are crucial mitigation steps.
For organizations, this incident underscores the expanding attack surface that now includes the recruitment process itself. Implementing secure testing environments, providing clear verification channels for candidates, and conducting regular audits of development workstations for suspicious scheduled tasks, modified Git hooks, or unexpected editor extensions are vital defenses. Rotating credentials on machines that have handled suspicious coding challenges should also be a standard practice to limit the potential damage from these sophisticated attacks.
The Mirage Kitten group's use of NodeRabbit and PollCat represents a concerning trend of attackers adapting their methods to exploit the software development lifecycle. By weaponizing the recruitment process and leveraging developer-focused tools, they aim to gain deep access into organizations, stealing source code, cloud credentials, and corporate access, ultimately posing a significant threat to the software industry.