A fake coding challenge is the new way in for an Iranian state hacking group, and the malware it delivers now runs on macOS. The two implants, uncovered by Kaspersky, mark the crew’s first publicly documented move to cross-platform tools.
Kaspersky tracks the group as Mirage Kitten, while other researchers call it Nimbus Manticore; the Iranian Dream Job nickname reflects a long history of recruitment lures. Past campaigns leaned on native Windows malware written in C, C++ and Go, usually delivered via DLL search-order hijacking. The newcomers, NodeRabbit and PollCat, are Node.js and obfuscated JavaScript trojans that also target Linux and macOS.
The delivery chain starts on LinkedIn. The hook plays out on LinkedIn: someone posing as a talent acquisition specialist at a big tech company asks an engineer to take a three-hour technical assessment, then ships a ZIP file presented as the challenge. One archive, Front-Technical-Challenge.zip, held a project management app whose server.js imported a trojanized npm package called colorized_terminal; the package silently launched an implant from a hidden cache folder as a detached background process.
NodeRabbit answers to Azure-hosted command servers, wraps its traffic in AES-256-GCM, and can enumerate files, run shell commands, read and write data, and drop a temporary Node.js script that executes and deletes itself. Persistence is per-platform: a Run registry key on Windows, a cron entry on Linux, a launch agent on macOS, disguised as a browser update or driver helper. Kaspersky found three variants across machines in Afghanistan, Egypt and Ethiopia. PollCat spreads through time-limited tests styled as capture-the-flag exercises.
Developers should treat unsolicited take-home challenges warily, especially archives that bundle their own node_modules directory, and inspect any code that executes before it is reviewed.
