Iran-linked Mirage Kitten activity is a useful reminder that “developer security” is no longer just about source-code quality. In Kaspersky’s latest Securelist research, the group is tied to two previously undocumented cross-platform remote access trojans — NodeRabbit and PollCat — delivered through fake recruiter outreach and trojanized coding challenge archives.

The tactic is simple and nasty: make the target behave like a normal job candidate. A recruiter persona sends a time-limited programming assessment. The developer downloads a project, opens it locally, installs dependencies, and runs the app. Buried inside the challenge is malicious JavaScript or a bundled npm package that launches the implant in the background.

For SMBs and government contractors, the important lesson is not “avoid LinkedIn.” It is that recruiting workflows, developer laptops, package execution, and code-review habits now sit directly inside the intrusion path.

What Kaspersky reported

Kaspersky says Mirage Kitten used job-search and recruiter-themed spear phishing to distribute trojanized coding challenges to targets in aviation and financial technology sectors across the Middle East and Africa. The campaign included two newly documented malware families:

  • NodeRabbit, a Node.js-based remote access trojan targeting Windows, Linux, and macOS.
  • PollCat, an obfuscated JavaScript RAT also delivered through malicious programming assessments.

In one case, the archive appeared to contain a normal Express, React, and Vite project. The instructions told the candidate to focus on frontend bugs and avoid modifying the server component. That matters because the malicious import was placed in the server-side code path. The bundled npm package launched an implant from a hidden cache-like directory while the candidate believed they were simply running a technical assessment.

Kaspersky also noted operational evolution across NodeRabbit variants: OS-specific persistence, encrypted command-and-control traffic, corporate proxy handling, anti-analysis checks, Outlook artifact harvesting, fake VS Code extension persistence, and Git hook injection. PollCat added its own fake assessment flow with attacker-controlled OTP logic and background command polling.

Original research: Kaspersky Securelist — Mirage Kitten targeting aviation and FinTech sectors with NodeRabbit and PollCat.

Why this matters

This campaign works because the behavior it abuses is normal. Developers routinely clone unfamiliar repositories, run package managers, start local servers, open code in VS Code, and troubleshoot errors under time pressure. A hiring challenge adds urgency and social legitimacy. If the “assignment” comes from a convincing recruiter account, the target may bypass their usual skepticism.

That makes developer workstations high-value entry points. They often have:

  • Cloud credentials and CLI tokens.
  • GitHub, GitLab, or Bitbucket access.
  • SSH keys and VPN profiles.
  • Access to CI/CD systems.
  • Local copies of sensitive repositories.
  • Security tools that attackers can fingerprint.

Once an attacker lands on that workstation, the next move may not be ransomware. It may be quiet repository access, credential collection, persistence through developer tooling, or staging for a supply-chain intrusion.

The defensive angle for SMBs and government contractors

Small teams often treat developer laptops like ordinary endpoints. That is a mistake. A developer endpoint can be a build system, a secrets store, a deployment jump box, and a source-code archive all at once.

The Mirage Kitten tradecraft points to several concrete controls.

1. Isolate recruiting and coding assessments

Do not run external coding challenges on your daily workstation. Use a disposable VM, cloud sandbox, or locked-down secondary machine with no production credentials. The environment should have no saved browser sessions, no personal SSH keys, no mounted company drives, and no access to internal VPN routes.

2. Treat bundled dependencies as suspicious

A project that includes its own node_modules directory deserves extra scrutiny. Modern JavaScript projects usually expect dependencies to be installed from a lockfile. Bundled packages, hidden cache paths, unexplained imports, and instructions that steer reviewers away from specific files are all warning signs.

3. Review startup paths before running code

Before running an unfamiliar project, check package.json scripts, server entry points, install hooks, postinstall behavior, imported local packages, and environment-file usage. For Python, Go, Rust, Java, and .NET projects, apply the same idea: identify what executes first and what external processes it starts.

4. Monitor developer persistence locations

This campaign used persistence paths that defenders should be able to hunt:

  • macOS LaunchAgents created by unexpected developer projects.
  • Linux crontab @reboot entries tied to Node.js scripts.
  • Windows Run keys and scheduled tasks masquerading as browser or driver updates.
  • Unexpected VS Code extensions or extension files.
  • Modified Git hooks such as post-merge and post-checkout.

5. Segment credentials from experimentation

If a developer needs to evaluate untrusted code, the test environment should not inherit their real cloud profile, deployment keys, password-manager session, or browser cookies. This is especially important for government contractors handling controlled project data, proposal material, client environments, or CMMC-scoped systems.

Bulwark Black assessment

Mirage Kitten’s NodeRabbit and PollCat activity is part of a broader pattern: nation-state and financially motivated actors are turning normal business workflows into execution channels. Recruiting, software trials, vendor demos, browser-based collaboration, and AI coding tools all create moments where users are expected to trust unfamiliar code quickly.

The practical answer is not paranoia. It is workflow design. Make the safe path the default path. External code runs in a disposable environment. Developer credentials stay out of that environment. Endpoint telemetry watches persistence locations that attackers actually use. Security review includes the boring files — startup scripts, hidden directories, lockfiles, extensions, and hooks — not just the visible application logic.

If your organization has developers, contractors, analysts, or administrators who receive external “technical assessments,” build a standard process now. The cost of a disposable sandbox is low. The cost of a compromised developer workstation can be the entire trust chain.