An Iran-linked espionage group contacted developers and other tech specialists with fake job offers on LinkedIn and similar platforms. Victims were pushed to quickly download and run “coding challenges” that secretly installed new malware, giving attackers remote access and long-term persistence. The campaign focused on aviation/aerospace and financial technology targets in parts of Africa and the Middle East.
This campaign relied on a fake hiring process to get developers to execute code on their own machines. Recruiters reached out on job-search platforms like LinkedIn with what looked like legitimate tech job offers, then directed candidates toward a coding challenge hosted on cloud storage. Once the developer downloaded and ran the project as instructed, a hidden malicious component executed alongside it. Two malware families, tracked as NodeRabbit and PollCat, were disguised inside these coding challenges and gave attackers remote access and long-term persistence on infected machines.
The scheme worked because it mimicked a familiar, low-friction process: technical hiring tests that developers routinely complete as part of interviewing. Attackers layered pressure tactics on top of that trust. Some targets were given only one to three hours to complete a task, and one variation used a single-use six-digit access code valid for only a short window, pushing candidates to open the project quickly rather than review it. One coding test even banned the use of AI assistants, a rule researchers suspect was meant to stop such tools from flagging the hidden malicious code.
Organizations in software development, aviation, aerospace, and fintech, where this campaign concentrated its targeting, should treat unsolicited recruiter messages as a social-engineering risk rather than routine outreach. Developers should never run unfamiliar coding test files directly on a work or personal machine; instead, any hiring assessment should go through a sandboxed environment or an established, vetted testing platform. Security and recruiting teams should also train staff to recognize urgency-based pressure, such as tight deadlines or single-use codes, as a manipulation tactic rather than a normal part of a hiring process, and to verify recruiter identities through official channels before engaging further.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Fake recruiters contacted developers on job platforms with tech job offers and directed them to download a coding challenge hosted on cloud storage, encouraging them to run the project immediately, which secretly executed hidden malicious code alongside it.
Attackers used short deadlines of one to three hours and, in one case, a single-use six-digit access code valid only for a short time, pushing candidates to open the project quickly instead of reviewing it carefully.
One coding test explicitly banned the use of AI assistants, which researchers said may have been intended to prevent such tools from detecting the malicious code hidden in the project.
The group used legitimate Microsoft Azure and Cloudflare infrastructure, and in some cases included the targeted organization's name in an Azure subdomain, making malicious traffic look like normal corporate network activity.
You get a LinkedIn message: a great dev role, and they want you to run a quick coding test. Looks legit, right? In a recent campaign, fake recruiters sent ‘coding challenges’ that secretly installed NodeRabbit or PollCat malware when devs ran the project from Amazon cloud storage or Azure links. The hook is pressure: 'Fix this app in three hours.' 'Single-use six-digit code.' 'Do not use AI assistants.' All designed so you run unknown code on your own machine without really checking it. If a recruiter you don’t know wants you to download and run a coding test, stop and send it to security before you ever execute the project.
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Kaspersky reports an active OkoBot malware campaign targeting Windows users who manage cryptocurrency. Victims are lured via “ClickFix” fake-error pages that trick them into running PowerShell commands, and via GitHub repos posing as legitimate software downloads. The malware then steals wallet…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
