A fake coding test forbade AI assistants. The researchers say an AI would have caught the malware.
The rule is not about fairness. It removes the one control most likely to flag the trojanised import on line 1 of the file you were told not to open.
By Parminder Kumar Sharma · · 8 min read
Start with the attribution, because the headline is not the research
Kaspersky published this on 1 September 2026 as "Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set". Their confidence statement is precise:
"We attribute this activity to Mirage Kitten with a high degree of confidence based on the following observations:"
Read that carefully. The high-confidence claim is that this malware belongs to a known cluster. It is not a claim about a country. The word "Iran" does not appear anywhere in the report.
The nationality in the headlines arrives by inheritance. Third parties equate Mirage Kitten with UNC1549 and Nimbus Manticore. Mandiant assessed UNC1549 as Iranian in February 2024, and did so "with moderate confidence", using "suspected" in its own title. Check Point asserted it flatly in September 2025 with no qualifier at all.
The three rules in the README
The lure is a take-home engineering test, sent by someone posing as a talent acquisition specialist at a major technology company, over LinkedIn. Archives named Front-Technical-Challenge.zip and Task-FullStack.zip, hosted in an S3 bucket named to impersonate Oracle.
Three rules in the README, and what each one is for
The third rule is why this belongs on a site about AI security, and Kaspersky says the quiet part directly:
"Notably, an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized."
The rule banning AI assistants is an evasion control. Not an integrity measure, not a fairness measure. The attacker identified an AI code reviewer as the thing most likely to catch them, and wrote a rule to switch it off. A three-hour clock does the rest.
That inverts the usual framing on this site. Most weeks the story is an AI tool creating exposure. Here an AI tool is the control that works, and the attacker had to design around it.
The execution moment, and why the standard advice fails
The archive contains TaskFlow, an Express, React and Vite project-management app. The README says fix the frontend, and states that server.js is "bug-free and functions correctly" and must not be modified.
Line 1 of server.js is a require of a package called colorized_terminal, version 2.1.0. As Kaspersky puts it, the instruction "conveniently direct[s] attention away from the only application source file the attackers had altered."
Now the detail that matters operationally:
"The attackers bundled the package directly in the challenge task archive's
node_modulesdirectory rather than publishing it to the npm registry."
Once running, the package launches an implant from node_modules/.cache/.320697f1/index.js as a detached background process.
What "cross-platform" is and is not
NodeRabbit is a Node.js RAT and Kaspersky documents per-platform persistence in detail: Windows Run keys, Linux @reboot cron, macOS LaunchAgents named com.microsoft.edgeupdate and com.intel.dsa.helper. Three variants, masquerading as Microsoft Edge Update and Intel Driver and Support Assistant.
So the code is cross-platform, confirmed. But Kaspersky never states the operating system of a single victim. Victims are identified only by country: Afghanistan, Egypt, Ethiopia.
And the feature set leans heavily Windows. PE subsystem patching of node.exe, Run registry keys, curl.exe --proxy-anyauth for NTLM, WinHTTP proxy discovery, Outlook OST and PST harvesting, a RUNDLL command, a dedicated WSL persistence path, and drive-letter enumeration.
Cross-platform by construction. Not demonstrated in the wild. Note that The Hacker News hedges this correctly in its body text and not in its headline.
The prior art is North Korean, and nobody in the research says so
Lazarus has run this exact play. ESET documented it in September 2023: a fake Meta recruiter approached an employee at a Spanish aerospace company over LinkedIn Messaging and "sent two coding challenges required as part of a hiring process, which the victim downloaded and executed on a company device." ESET called it "a known Lazarus tactic, used at least since Operation DreamJob", which MITRE ATT&CK dates to September 2019.
Same social mechanism, three years apart
| Lazarus, 2023 | Mirage Kitten, 2026 | |
|---|---|---|
| Approach | Fake Meta recruiter on LinkedIn | Recruiter persona on LinkedIn |
| Artefact | Compiled binaries on ISO images | Node project in a ZIP |
| Execution | DLL side-loading on run | Import of a bundled dependency on run |
| Who runs it | The candidate, on a work device | The candidate, on a work device |
| Payload | LightlessCan RAT | NodeRabbit RAT |
Be careful with this comparison. Kaspersky makes no reference to North Korea, Lazarus or Dream Job. ClearSky named an "Iranian Dream Job" campaign in November 2024 and argued the imitation was deliberate misdirection rather than convergence, but their site was unreachable during this research, so that reading reaches us second hand and we are not resting anything on it.
What is solid: this cluster has used recruitment lures since at least June 2022, per Mandiant, including fake hiring sites for aviation and aerospace roles. The recruitment lure is not borrowed. The coding-test-as-payload refinement is the newer part.
What to actually do
Take this with you
For engineering leaders and anyone taking technical assessments
- Run candidate-supplied code only in a disposable VM. This is the control that survives regardless of the execution primitive, because the trigger here was simply starting the app, which is what the exercise asks for. Note that Kaspersky publishes no mitigations section at all, so this is our recommendation grounded in the mechanism.
- Treat a bundled node_modules as the red flag it is. A legitimate assessment has you install dependencies yourself. A dependency shipped inside the archive has bypassed the registry, and with it every scanner you own.
- Keep Workspace Trust on in VS Code, because the malware attacks it. One NodeRabbit variant explicitly tries to disable Workspace Trust, and installs a fake extension displayed as GitHub Copilot Helper. The operators consider it worth defeating.
- Grep your repositories for the marker # shepherd-persist in .git/hooks/post-merge and .git/hooks/post-checkout. That is the comment the Git-hook persistence leaves behind.
- Treat a hiring process that forbids AI code review as a signal. On the researchers’ own reading, that rule exists to remove the control most likely to catch a planted dependency.
- Watch for the named artefacts: scheduled tasks IntelDriverSupportUpdate at 10:00 and NetSync_<username> at 09:00, LaunchAgents com.microsoft.edgeupdate and com.intel.dsa.helper, and node processes beaconing to azurewebsites.net.
The position
There is no CVE here and there cannot be one. Verified against the CISA Known Exploited Vulnerabilities catalogue, version 2026.08.31, 1,687 entries: nothing matches. No software flaw is exploited. The developer runs the project because they were asked to, which is precisely why it works and why there is nothing to patch.
The finding worth taking to a board is not the malware. It is that an attacker looked at a developer's toolchain, decided the AI code reviewer was the most dangerous thing in it, and wrote a rule to turn it off. We have spent two years on this site cataloguing the exposure that AI tooling creates, and much of that stands. This is the other column in the ledger.
If you run technical assessments, the practical consequence is small and immediate: candidates should be told to run them in a VM, and a client or employer who forbids AI review during an assessment has just told you something about themselves.
