Iran's Mirage Kitten Phishes Engineers With Fake Jobs

A recruiter from a major technology company messages you on a job platform. The role fits. There is a technical assessment, a link to an archive, and a three hour window to finish it. You unzip the project, run npm install, and a state backed remote access trojan launches as a detached background process before you have written a line of code.

That is the whole intrusion. No corporate perimeter was breached, because none was involved.

Key Takeaways

• Kaspersky published its analysis of NodeRabbit and PollCat on Securelist on 1 September 2026, attributing both to Mirage Kitten with high confidence.
• NodeRabbit is a Node.js remote access trojan that runs on Windows, Linux and macOS, delivered inside trojanized npm packages named colorized_terminal and pretty-log, both versioned 2.1.0.
• Mirage Kitten gave NodeRabbit targets a three hour limit and PollCat targets a one hour session guarded by a six digit code that rotates every 30 seconds.
• PollCat launches at project startup regardless of whether the victim ever enters that code, so the authentication step is theatre rather than a gate.
• Kaspersky confirmed three infected systems, in Afghanistan, Egypt and Ethiopia, across aviation, aerospace and fintech.

Who Is Mirage Kitten?

Mirage Kitten is an Iran linked espionage group working the aerospace, aviation, defence and telecommunications sectors of the Middle East and Africa since at least 2022. It answers to four vendor names: UNC1549 at Google, Smoke Sandstorm at Microsoft, Nimbus Manticore elsewhere, Mirage Kitten at Kaspersky.

Google Threat Intelligence published its own analysis of UNC1549 tradecraft on 17 November 2025, describing campaigns since mid 2024 built on lures "related to job opportunities or recruitment efforts". The recruitment theme is not new. What Kaspersky documented is the group rebuilding its toolkit in JavaScript to ride that lure further.

Iran runs several of these programmes at once and they do not look alike. Gblock covered MuddyWater dressing espionage up as ransomware, an operation aimed at organisations. Mirage Kitten aims at named individuals.

How Does a Fake Job Offer Deliver NodeRabbit?

It delivers it through the dependency tree of the coding challenge you were asked to complete. Kaspersky's Omar Amin traced archives such as Front-Technical-Challenge.zip and FrontEnd-Task.zip hosted in an Amazon S3 bucket named oracle-challenge, a name chosen to borrow a real company's credibility from the URL bar alone.

Inside the project, two packages carried the payload and silently started an implant from node_modules/.cache/.320697f1/index.js as a detached background process. Those packages install like any other because npm runs the postinstall lifecycle script automatically during a normal install. Nothing asks permission.

Kaspersky found three NodeRabbit variants, and the progression is worth reading as a roadmap:

• Variant 1, Afghanistan. Eleven commands, a fixed local port at 127.0.0.1:48739, traffic encrypted with AES-256-GCM to Azure hosted endpoints.
• Variant 2, Egypt. Same command set, plus sandbox detection, proxy support and corporate NTLM authentication delegation, and a port derived from a victim identifier rather than hardcoded.
• Variant 3, Ethiopia. Twenty three commands, and persistence through a malicious VS Code extension and injected Git hooks.

That third variant is the detail most coverage skipped. Trojanized recruitment archives, npm postinstall execution and VS Code persistence were until recently the signature of North Korean operations, including the campaign where opening a VS Code project was enough to install malware. An Iranian group has now adopted that playbook end to end. Techniques that work on developers travel between states faster than defences do.

Why Does the Countdown Timer Matter?

Because the timer is aimed at your judgement, not your schedule. As The Record reported on 1 September 2026, NodeRabbit lures carried a three hour limit and PollCat lures a one hour session. Three hours is long enough to feel like a genuine assessment and short enough that you will not stop to email the company's careers address and ask whether this person exists.

PollCat wraps the same pressure in a login flow. Victims received a RankChallenge-react project posing as a competitive coding platform, gated behind a six digit code rotating every 30 seconds. Kaspersky's finding is that the malware activates at startup independently of that check. The code exists to make the deadline feel administered by a real system.

PollCat then polls its server every two minutes, exposes 22 commands including arbitrary JavaScript execution, and inventories the host for 24 named security products. It also treats an HTTP 400 response as a successful registration, a deliberate inversion designed to look like failed traffic in a proxy log.

Why Do Domain Reputation Defences Fail Here?

They fail because nothing in the chain is hosted anywhere suspicious. The archives sat in Amazon S3, and the command and control endpoints were azurewebsites.net subdomains and Cloudflare fronted domains. Kaspersky notes the sharpest touch: Mirage Kitten built the targeted organisation's own name into its Azure subdomain, so beacon traffic reads as that company's internal tooling. Set that against the 47 Azure domains listed in Google's November 2025 UNC1549 indicator set and the picture is a group that has industrialised borrowed reputation.

One number deserves scepticism in the other direction. Kaspersky confirmed three infected systems, but also mapped roughly 11 further domains registered through NameCheap between May and July 2026, and saw sample submissions arrive from India, Türkiye, Israel, Iraq, Germany and Ireland. Three is what forensic access could prove. It is a floor, not a total.

What This Means for Your Personal Inbox

This campaign works because it never touches a corporate mail gateway. The approach lands as a platform message, then the archive link, the brief and the rotating code all arrive at the personal address you gave a recruiter. MITRE catalogues the move as Spearphishing via Service, T1566.003, noting that third party services "are more likely to have a less strict security policy than an enterprise".

Job hunting also disables the instinct that normally protects you. Unsolicited attachments from strangers are the definition of a phish and also the definition of a hiring process. Candidates are expected to download files, run unfamiliar code and answer quickly, which is why fake interview flows aimed at Google account credentials keep working on people who would never fall for an invoice scam.

For journalists and NGO staff the cover story simply adapts. Swap the coding challenge for a fellowship application or a freelance commission and the funnel is unchanged. Iranian operators have run that variation before, posing as cybersecurity experts to reach reporters' Gmail accounts. The personal mailbox is the perimeter, and one person defends it.

How Should You Handle a Take Home Assessment?

Assume the archive is hostile until you have proved otherwise, and make proving it cheap.

• Verify the recruiter out of band. Find the company's official careers page yourself and confirm the role and the person exist. Never use a link supplied in the approach.
• Treat the deadline as the tell. Real employers extend timers. An assessment that expires in three hours is optimising for the fact that you did not check.
• Never run it on your primary machine. A disposable virtual machine with no saved credentials, no SSH keys and no signed in browser turns a compromise into a wasted evening.
• Read the manifest before you install. Inspect every preinstall, postinstall and prepare hook in package.json, then install with npm install --ignore-scripts, documented in the npm config reference.
• Distrust dependencies you cannot find. No public registry history, no repository and a version as tidy as 2.1.0 is a red flag on its own.
• Check what persists afterwards. Scheduled tasks, cron entries, LaunchAgents, Git hooks and newly installed VS Code extensions are all places Mirage Kitten left itself.

What to Watch Next

Watch whether the sector list holds. Mirage Kitten's earlier toolkit, documented in Kaspersky's July 2026 write up of the NightLedger backdoor, reached victims in Egypt, Jordan, Tanzania, Pakistan, Ethiopia and Burkina Faso. Moving to Node.js costs the group almost nothing and buys every platform an engineer might use, so the limit on who gets hit is now recruitment reach, not malware compatibility.

Then watch whether hiring changes. As long as a normal technical interview requires a stranger's code to run on a candidate's laptop under time pressure, the lure needs no innovation at all.