Fintech and aviation companies across the Middle East and Africa are being targeted with two new malware families, NodeRabbit and PollCat, in a campaign linked to the Iranian state-backed threat group Mirage Kitten.
The malware is cross-platform and are both delivered through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives, according to Kaspersky research published Tuesday.
Behind the malware is the advanced persistent threat (APT) group Mirage Kitten, which is the same group behind an earlier Middle East and Africa campaign Kaspersky reported in July. The APT is also known as is also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore. The group is Iranian state-backed (APT) specializing in cyber-espionage operations targeting aerospace, aviation, defense, and telecommunications sectors.
Fix the Bugs, Meet the Bug
Kaspersky said targets are tricked into downloading the coding challenges, which are Zip archives that contain technical-assessment files that are part of the fake recruitment process.
One archive recovered by Kaspersky, Front-Technical-Challenge.zip, was hosted on Amazon’s cloud storage — a trusted, legitimate-looking home for what was designed to pass as a real coding test. Inside was TaskFlow, a working app built with Express (a Node.js backend framework), React (a frontend library), and Vite (a development build tool) — a completely ordinary tech stack for a genuine software engineering assessment.
The accompanying README instructions gave the candidate a simple task to review the app and fix the bugs in its frontend. It also gave one explicit instruction not to touch server.js, describing that file as “bug-free.” That was the tell, Kasperky noted. The server.js was the one file the attackers had actually altered, and the instruction not to touch it was meant to prevent the candidate from more closely examining the file.
The README also said candidates had three hours to complete the challenge, and were barred from using AI coding assistants. The attackers hid the malicious package inside the archive itself, so it never appeared in the public registry where it could be checked or flagged. The moment a candidate opened the project, it quietly launched NodeRabbit in the background.
The Candidate Passed. So Did the Malware
NodeRabbit is a cross-platform RAT built with Node.js that runs on Windows, Linux, and macOS. PollCat, the second tool, is written in obfuscated JavaScript and was distributed the same way — bundled inside a separate trojanized coding challenge built around a React app.
Kaspersky also found a second RAT, PollCat, hidden in a different fake coding test — this one asking candidates to enter a six-digit access code from the “recruiter” to unlock the challenge. But the code was a distraction: PollCat launched the moment the project opened, before anyone typed in a code at all.
Both were built to give the attackers remote control of an infected developer’s computer — letting them run commands, read and steal files, and stay hidden and persistent, all without the victim knowing.
The main difference was just how they got in. Once installed, both did the same job: quietly handing the attackers ongoing access to that machine.
Different Kitten, Same Dream Job
Mirage Kitten’s tactic is a well-documented page from North Korea’s playbook. Lazarus Group has run a similar long-running campaign known as Operation Dream Job for years, using fake recruiters and trojanized coding tests to target developers.
Check Point reported in August that the tactic resurfaced with a previously undisclosed Windows zero-day aimed at aerospace and defense workers in Europe and India. Security firm ReversingLabs has separately tracked Lazarus-linked malicious coding-test packages on npm – one, disguised as a math utility library, was downloaded more than 10,000 times before it was caught.
