The README told the candidate that server.js was already bug free and should not be touched. It was the only application source file the attackers had changed.
That archive, a take home coding challenge sent to an engineer who believed they were applying for a job, is how the espionage group Mirage Kitten is getting remote access trojans onto developer machines. In research published on 1 September, Kaspersky's Omar Amin documents two previously undocumented malware families, NodeRabbit and PollCat, delivered inside trojanized assessment projects hosted on Amazon S3 by fake recruiter accounts on LinkedIn and other job platforms. Kaspersky found victims in the fintech, aviation and aerospace sectors across the Middle East and Africa, on systems in Egypt, Ethiopia and Afghanistan.
A three hour timer and a ban on AI helpers
The lure contained TaskFlow, a plausible engineering assessment built with Express, React and Vite. Its README imposed a three hour limit and banned AI assistants. Amin points out that an AI code reviewer would likely have flagged the suspicious first line import of an unknown package.
That import was a package called colorized_terminal, pinned to version 2.1.0, which the attackers bundled straight into the project's node_modules folder rather than publishing it to the npm registry. Loading it silently launched an implant as a detached background process. A second lure used a package named pretty-log the same way.
The group swapped C for JavaScript
Mirage Kitten has historically shipped native malware written in C, C++ and Go, deployed through DLL search order hijacking. Kaspersky calls NodeRabbit and PollCat the first publicly documented use of Node.js and JavaScript based malware by this group. Both run on Windows, Linux and macOS from one codebase, and both look at home on a developer's workstation.
Kaspersky recovered three NodeRabbit variants, each from a different country. The first supported 11 commands; the third supports 23 and masquerades as Microsoft Edge Update or Intel Driver and Support Assistant. Traffic runs over Azure Websites subdomains, and in some cases the operators worked the target organization's own name into the subdomain so beacons blended into normal business activity.
It hides where developers do not look
The newest variant adds two persistence tricks aimed at engineers. One installs a fake Visual Studio Code extension displayed as GitHub Copilot Helper, borrowing a publisher name from local extension metadata and attempting to disable Workspace Trust. The other appends a launcher to a repository's own Git hooks, post-merge and post-checkout, behind the marker # shepherd-persist, so the next Git operation restarts the implant. We covered a separate campaign abusing lookalike VS Code extensions in August.
PollCat arrives in its own React challenge, gated behind a six digit code that Kaspersky says the recruiter persona could hand the target directly. It does not wait for the code: it starts during application startup and registers with its server while the login page is still loading.
There is no patch for a job offer
None of this is a software flaw, so there is nothing to patch. Treat unsolicited assessment archives as untrusted code and run them, if at all, in a disposable virtual machine holding no credentials. Look inside node_modules for packages that are not in your lockfile, check .git/hooks for the shepherd-persist marker, and audit scheduled tasks and login items for entries named after Microsoft Edge or Intel driver support. Kaspersky notes the delivery has not changed: recruiter personas on LinkedIn, aimed at the same sectors and regions described in its earlier reporting on the group. Only the payload is new.
Indicators
- Front-Technical-Challenge.zip, MD5 1ea83e4e4592b01e4acab63eb867bee5, staged at hxxps://oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com
- hxxps://plugplay[.]azurewebsites[.]net, hxxps://visitfinancedentists[.]com (NodeRabbit)
- hxxps://lifespotify[.]com, hxxps://sahi-finance[.]com (PollCat)
The malware is the least surprising part. A recruiter's message, a zip file and a countdown got an engineer to run attacker supplied code on a corporate laptop, with nothing on the network broken first.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.