Iranian hackers fake job postings on LinkedIn to trick Devs into downloading RAT malware
09 Oct 2026
A report from GBHackers reveals a campaign linked to the Iranian hacker group Mirage Kitten, which uses fake LinkedIn profiles posing as employers to deceive software developers in the aviation and FinTech industries in Egypt, Ethiopia, and Afghanistan into downloading coding tests embedded with RAT malware, including NodeRabbit and PollCat RAT, which support Windows, macOS, and Linux
The deception starts with a fake job application test
The attackers send a file named Front-Technical-Challenge.zip, which contains the TaskFlow project developed with Express, React, and Vite, with a deadline to complete the test within 3 hours to pressure the candidates to start immediately, instructing not to modify the server.js file, which hides commands to activate the dangerous package colorized_terminal version 2.1.0, enabling the NodeRabbit malware in the background
What can NodeRabbit and PollCat RAT do?
NodeRabbit can collect hardware information, operating system, and MAC Address, monitor processes, execute Shell commands, read and write files, and receive scripts from the control server, using AES-256-GCM encryption for communication
Meanwhile, Kaspersky detected another campaign using a React test named RankChallenge-react to lure victims into installing PollCat RAT, which, in addition to controlling the machine and collecting data, can also stealthily send files out of the machine, monitor drives, and create processes that hide its operation
Protection tips for developers
Verify the identity of the employer before downloading files
Check the code and packages attached to the project before running
Do not let time constraints neglect security
Test untrusted code in an environment separate from the main machine
This case serves as a reminder that even seemingly trustworthy job offers on LinkedIn can be a channel for spreading malware, so developers should always check the code before executing it
Source: gbhackers.com
Other related
Warlock, Ransomware, Malware, Microsoft SharePointWarlock Ransomware Breaches Organizations via SharePoint, Disabling Security Defenses for Up to 2 Hours
IT News, Safari, Apple, Adaptive Dark ModeSafari Tests Adaptive Dark Mode, a Feature That Automatically Converts Websites to Dark Mode
IT News, Microsoft Edge, PDF
