Iran Linked Hackers Are Posing as LinkedIn Recruiters to Infect Developers, Kaspersky Warns

An Iran linked cyber espionage group is using fake recruiters, convincing job offers and malicious coding tests to infect the computers of software developers, according to new research from Kaspersky.

The campaign, attributed by Kaspersky to the advanced persistent threat group Mirage Kitten, targets people working in aviation, aerospace and financial technology.

Malware connected to the campaign has been detected in several countries, including Israel, Germany, Türkiye, India and Ireland, while Kaspersky identified infected systems in Afghanistan, Egypt and Ethiopia.

The attackers are exploiting something many developers would normally welcome: a recruiter contacting them on LinkedIn with an attractive job opportunity.

The attack begins with a job offer

According to Kaspersky's Global Research and Analysis Team, attackers create or operate accounts posing as recruiters for major technology companies.

They then approach software engineers and invite them to complete a technical assessment as part of a supposed hiring process.

Instead of sending an obviously suspicious executable file, the recruiter provides what appears to be a legitimate coding challenge. In cases analyzed by Kaspersky, the files were hosted using legitimate Amazon cloud infrastructure.

The candidate is typically given just one to three hours to complete the assignment.

Some of the instructions specifically warn the candidate not to use AI coding assistants.

That detail may serve a purpose. Kaspersky researchers found that an AI code review tool examining the project could potentially notice suspicious components hidden inside the files.

Once the developer downloads and runs the project, the malicious code can execute quietly in the background while the victim concentrates on completing the supposed job test.

Two new malware tools: NodeRabbit and PollCat

Kaspersky identified two previously undocumented remote access trojans used in the operation, named NodeRabbit and PollCat.

NodeRabbit is built using Node.js and can operate across Windows, macOS and Linux.

Once installed, it can give attackers extensive access to the compromised computer, including the ability to inspect files, execute commands, examine running processes and gather information about the system.

More advanced versions can also attempt to maintain access through tools developers use every day.

Kaspersky found techniques involving fake Visual Studio Code extensions and modifications to local Git repositories that can cause the malware to run again during normal development activity.

PollCat is another remote access trojan, written in JavaScript.

It is delivered through a similar fake programming assessment. One version presents the candidate with a six digit, one time access code supposedly supplied by the recruiter and creates additional pressure through a short completion window.

Behind the legitimate looking interface, malicious software can collect system information, examine directories and communicate with attacker controlled infrastructure.

Why developers are such valuable targets

Compromising a developer's laptop can potentially give an attacker much more than access to one person's files.

Development computers may contain source code, private repositories, SSH keys, authentication tokens, saved credentials and access to internal corporate systems.

That makes developers particularly attractive targets for espionage operations.

Asaf Hazan, CTO of Kaspersky Israel, warned that the danger comes partly from the amount of professional information people voluntarily publish online.

A LinkedIn profile can reveal a person's employer, role, technical expertise, projects and technologies they use. An attacker can use that information to create a recruitment approach tailored specifically to the victim.

A malicious coding test could therefore turn what appears to be an attack against an individual job seeker into an entry point into an entire company.

A shift in Mirage Kitten's tactics

The new malware also represents a technical change for the group.

Kaspersky says Mirage Kitten previously relied primarily on native malware written in languages including C, C++ and Go, with much of its tooling focused on Windows.

Using Node.js and JavaScript allows attackers to reuse much of the same code across Windows, macOS and Linux, an important advantage when targeting software engineers who may work on any of those operating systems.

The campaign also fits a broader pattern previously documented by cyber security researchers involving Iran linked threat actors using fake employment opportunities to approach people working in sensitive technology, aviation and defense sectors.

How to recognize a suspicious recruitment attempt

Kaspersky advises developers not to stop using LinkedIn, but to treat unexpected recruitment messages with the same caution they would apply to suspicious emails.

Job seekers should independently verify both the recruiter and the advertised position rather than relying solely on the LinkedIn profile contacting them.

Developers should be particularly cautious when a technical assessment requires them to download and execute an unfamiliar project on their own computer.

Artificial urgency is another warning sign. A recruiter insisting that a coding test must be downloaded and completed within an unusually short period deserves additional scrutiny.

Candidates should also never provide passwords, account credentials or genuine authentication codes simply because someone claiming to be a recruiter requests them.

For developers, there is an additional precaution worth considering: an unknown coding project should not automatically be trusted simply because it looks like an ordinary programming assignment.

The fake interview may be convincing. The company name may be real. The cloud hosting may be legitimate. Even the coding exercise may work exactly as expected.

The dangerous part can be running quietly underneath it.