In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.

Curate Feeds | Make Collections | Customize Email Briefs

Nimbus Manticore uses trojanized coding challenges to deploy NodeRabbit and PollCat RATs across Windows, Linux, and macOS.

In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.

✓ Cyber Security Awareness guidance on fake LinkedIn job offers, NodeRabbit and PollCat RATs, phishing training, and practical human-risk reduction for teams.

イラン系のサイバースパイグループ「Mirage Kitten」が、LinkedInや求人検索プラットフォーム上で偽の採用担当者を装い、ソフトウェアエンジニアを標的にしていることが判明しました。 攻撃者はトロイの木馬化したコーディング課題を利用し、これまで報告されていなかった2種類のクロスプラットフォーム型リモートアク

At a Glance Actor or group Allegedly Mirage Kitten (UNC1549, Smoke Sandstorm) Activity type Cyberespionage and remote access trojan deployment Targets or victims Aviation, aerospace, and fintech developers Scale Multiple targeted victims across several countries Law-enforcement status No announced arrests; active campaign Sources Kaspersky Labs TL;DR Suspected threat actors are using a Mirage Kitten malware campaign to target software engineers. First, they hide malware inside fake coding tests sent via professional networking sites.

Nimbus Manticore uses trojanized coding challenges to deploy NodeRabbit and PollCat RATs across Windows, Linux, and macOS.

Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware. Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were […]

✓ Phishing detection teams should watch Mirage Kitten’s fake coding tests, where NodeRabbit and PollCat RATs target developers through job-related lures.

Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware.

In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.

Kaspersky uncovers NodeRabbit and PollCat, new cross-platform RATs from Mirage Kitten, delivered via fake coding challenges on LinkedIn.

Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware.

Cet article de recherche documente la découverte de deux nouvelles familles de malwares attribuées à Mirage Kitten (également connu sous les noms UNC1549, Smoke Sandstorm, Nimbus Manticore), un groupe APT ciblant historiquement le Moyen-Orient et l'Afrique. La campagne repose sur une technique de faux recruteur (recruiter persona) sur LinkedIn et d'autres plateformes d'emploi.

Kaspersky identified two previously undocumented cross-platform RAT families, NodeRabbit and PollCat, used by Mirage Kitten in trojanized coding challenges delivered through recruiter lures on LinkedIn and other job platforms. The campaign targets Windows, Linux, and macOS, with infrastructure and lures tied to domains and services including Amazon S3, Azure Websites, Cloudflare, and the domains oracle-challenge.s3[.]us-east-1.amazonaws[.]com, plugplay.azurewebsites[.]net, and lifespotify[.]com. #MirageKitten #NodeRabbit #PollCat #LinkedIn #AmazonS3 #AzureWebsites #Cloudflare

イランと関連のある脅威アクター「Mirage Kitten」が、ソフトウェア開発者を標的に偽の採用選考課題を送りつけ、その中に新たに確認された2種類のクロスプラットフォーム型リモートアクセス型トロイの木馬「NodeRabbit」と「PollCat」を仕込んでいることが分かりました。 今回のキャンペーンでは、Linke

In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.

Curate Feeds | Make Collections | Customize Email Briefs

Nimbus Manticore uses trojanized coding challenges to deploy NodeRabbit and PollCat RATs across Windows, Linux, and macOS.