This weekly threat bulletin includes real-world campaigns where attackers impersonate recruiters and use fake hiring steps to trick people into running malicious files. One campaign uses fake LinkedIn coding tests delivered via cloud links, and another uses fake job interviews with trojanized macOS installers that impersonate legitimate apps.
This threat bulletin describes two related recruiting-themed campaigns. In the first, activity linked to Mirage Kitten uses fake LinkedIn coding tests distributed through cloud links. Opening the test triggers installation of cross-platform implants, including malware referred to as NodeRabbit and PollCat. In the second, Contagious Interview activity relies on fake job interviews that ask candidates to download trojanized macOS disk images or installer packages disguised as legitimate Mac applications. Both approaches use the hiring process itself as the delivery mechanism, since a coding test or software install request feels like a normal part of applying for a technical job.
These lures work because they exploit a process most developers and engineers go through routinely: technical assessments and interview setup steps. A recruiting message that includes a cloud link to a coding test, or an interview step that asks for a local install, does not look unusual on its face. The pretext also targets people who are motivated to move quickly through a hiring process and may be less likely to question extra steps like installing an app or opening a file from an unfamiliar link.
Organizations, especially in fintech and aviation where these campaigns have reportedly targeted staff, should treat unsolicited recruiting messages and coding tests as a high-risk channel. Employees should verify a recruiter and the hiring process before opening links or downloading files, and should never install software as part of an interview or assessment unless it comes from a trusted, official source and is approved by IT or security. Because developers, engineers, and other high-demand technical roles are the most likely targets, awareness training should specifically address recruiting-themed lures and reinforce that legitimate hiring processes rarely require installing unverified software on a personal or work device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers linked to Mirage Kitten send fake LinkedIn coding tests distributed through cloud links that install cross-platform implants such as NodeRabbit and PollCat when opened.
Contagious Interview activity uses fake job interviews to convince candidates to download trojanized macOS disk images or installer packages that impersonate legitimate Mac applications.
The campaigns target developers, engineers, and IT staff, with reported targets including fintech and aviation organizations in Egypt, Ethiopia, and Afghanistan.
Warning signs include unsolicited recruiting outreach pushing a cloud link, coding tests that require installing something locally, and interview steps that ask you to install software from an unverified source.
Imagine this: a LinkedIn recruiter sends you a coding test for your dream fintech role. Iran-linked Mirage Kitten has used fake LinkedIn coding tests, sent as cloud links, to install NodeRabbit and PollCat malware on candidates’ machines. North Korea’s Contagious Interview even turns fake job interviews into malware installs, pushing trojanized macOS DMG or PKG files that pretend to be legit Mac apps. Here’s the move: if any recruiter asks you to install software or run a downloaded test, stop and send it to IT or security first. No approval, no install.
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers report Mirage Kitten (an espionage-focused threat group) targeted organizations in the Middle East and Africa using highly tailored spear‑phishing. The lures included recruitment-themed messages impersonating trusted brands/hiring sites and fake videoconferencing pages that redirected…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
