Fake LinkedIn Job Offers Hide Malware in Coding Tests
Attackers posing as recruiters on LinkedIn are sending software developers take-home coding tests that quietly install remote-access malware, according to research published by threat intelligence firm PolySwarm and reported by Cyber Security News on September 9, 2026.
Key facts
What happened: Fake recruiter accounts on LinkedIn and other job platforms send candidates a technical assessment that installs malware when run
Who's behind it: The Iran-linked group Mirage Kitten, also tracked as UNC1549, according to PolySwarm
The malware: Two newly documented remote access trojans, NodeRabbit and PollCat, which run on Windows, Linux and macOS
Who's affected: Organizations in fintech, aviation and aerospace, with victims observed in Egypt, Ethiopia and Afghanistan; wider exposure is suspected
What to do: Verify recruiters through official company channels and never run an unsolicited coding project on your main work machine
How does the fake job offer attack work?
The attacker opens with a convincing recruiter profile and an invitation to complete a technical assessment. One observed file, a ZIP archive named Front-Technical-Challenge.zip, contained what looked like an ordinary web project called TaskFlow with a README telling the candidate to fix frontend bugs.
The instructions specifically told candidates that one file, server.js, was safe and should not be modified. That file's first line loaded a malicious package hidden inside the project folder rather than downloaded from npm, the public registry developers normally install code from. Running the project launched NodeRabbit from a concealed location.
A remote access trojan, or RAT, is malware that gives an attacker ongoing remote control of a computer.
What makes this lure effective?
Pressure and plausibility. The message gave recipients three hours to respond and told them not to use AI assistants — both of which discourage the careful code review that would expose the trap.
The deeper problem is that developers download, open and run unfamiliar code as a normal part of interviewing. A coding test is not a suspicious attachment; it's the job. That makes this a supply-chain-style entry point rather than ordinary phishing.
A second lure, a React project called RankChallenge-react, carried the PollCat malware and displayed a fake one-time-password screen. The malware contacted its command server and began waiting for instructions as soon as the app loaded — even if the candidate never typed in a code.
What can the malware actually do?
NodeRabbit collects host and network details, lists running processes, executes shell commands and manipulates files. Newer versions detect analysis environments, understand corporate proxy settings, and can switch command servers to survive inside company networks. Its third variant expands to 23 commands and hunts for Outlook addresses, mounted drives, development projects and Git repositories.
Two persistence tricks stand out. It can install a malicious Visual Studio Code extension disguised as a GitHub Copilot helper, which fires when the editor opens. It can also insert a launcher into Git hooks — scripts that run automatically during routine repository actions — so ordinary day-to-day work restarts the malware.
PollCat offers file transfers, system inventory, hidden process execution, shell access and arbitrary JavaScript execution. It persists through scheduled tasks on Windows, cron jobs on Linux, and cron or LaunchAgent entries on macOS, while checking for signs of security software.
How to protect yourself and your team
For individuals: verify the recruiter and the job opening through the company's official website or main phone line before opening anything. Review every dependency and hidden project file. Never run unsolicited code on your primary workstation — use an isolated virtual machine for legitimate assessments.
For security teams: monitor developer endpoints for unusual Node.js activity, newly created editor extensions and unexpected changes to Git hooks. Review suspicious dependency trees and limit access to source repositories.
A compromised developer machine is rarely just one machine. It typically holds source code, internal repositories, stored credentials and active sessions to corporate services.
Sources: Cyber Security News; PolySwarm research report. Indicators of compromise are published in the PolySwarm report.