Hackers Exploit Job Offers on LinkedIn to Spread Malware

Software developers are increasingly becoming the target of cybercriminals who use fraudulent job offers on LinkedIn to deploy harmful software. These deceptive tactics have transformed standard coding exercises into conduits for distributing remote access trojans (RATs), posing significant risks to developers’ systems and data.

LinkedIn’s Role in Cyber Attacks

Cyber attackers, specifically the Iran-associated group Mirage Kitten, also known as UNC1549, have been leveraging recruiter personas on LinkedIn to distribute seemingly benign projects. Once executed, these projects unleash NodeRabbit and PollCat, two newly identified cross-platform RATs that threaten Windows, Linux, and macOS systems. This malicious campaign has been documented by PolySwarm and reported to Cyber Security News (CSN), impacting industries such as fintech, aviation, and aerospace.

Victims have been identified in regions including Egypt, Ethiopia, and Afghanistan, with evidence suggesting a broader reach. The nature of developers’ work—often involving downloading and executing unfamiliar code—makes them particularly vulnerable to such sophisticated social engineering tactics.

Technical Details of the Attack

The attack strategy begins with a convincing recruiter account inviting developers to undertake a technical challenge. One example, the ‘Front-Technical-Challenge.zip’, includes an Express, React, and Vite project named TaskFlow. Within this setup, hidden malicious code is executed when developers follow the provided instructions, which misleadingly assure the safety of certain files.

Similarly, another React-based task, ‘RankChallenge-react’, introduces PollCat malware by displaying a fake one-time-password screen. While candidates engage with the project, the malware connects to command-and-control servers to receive further instructions, even without user authentication.

Impact and Mitigation Strategies

NodeRabbit and PollCat significantly enhance their persistence and evasion capabilities. NodeRabbit can execute a range of actions, from gathering system information to manipulating files and environments. It is designed to withstand corporate security measures by understanding network settings and switching command servers. PollCat facilitates file transfers, executes hidden processes, and maintains system persistence using platform-specific methods.

To mitigate these risks, developers are advised to authenticate recruiter identities through official channels and thoroughly assess all code dependencies. Conducting tests in isolated environments rather than primary workstations can further reduce exposure. Security teams should monitor for unusual Node.js activities and scrutinize newly developed editor extensions and Git-hook changes to detect potential threats.

This campaign exemplifies how recruitment efforts can inadvertently become vectors for supply-chain attacks, emphasizing the importance of rigorous code reviews, identity verification, and segregated interview task environments to prevent RAT infiltration.

Indicators of compromise (IoCs) provided by PolySwarm include specific SHA-256 samples linked to NodeRabbit. It is critical for security operations centers (SOCs) to stay updated on emerging threats and employ early detection tools like ANYRUN to preempt incidents.