Hackers Pose as Recruiters and Send Fake Coding Tests to Infect Software Developers
Brief
Cybercriminals are posing as recruiters to turn routine job interviews into malware traps for software developers.
Their latest campaign delivers two cross-platform remote access tools, NodeRabbit and PollCat, through coding challenges that look like genuine take-home tests.
The activity has reached victims in aviation, aerospace and financial technology across Egypt, Ethiopia and Afghanistan.
It also shows how a seemingly ordinary project download can give attackers a foothold on a developer workstation, where source code, cloud credentials and corporate access may be within reach.
Researchers at Securelist identified the previously undocumented NodeRabbit and PollCat families while tracking the Mirage Kitten group.
Securelist said in a report shared with Cyber Security News (CSN) that this is the group’s first publicly documented use of Node.js and JavaScript implants.