An Iran-linked cyberespionage group known as Mirage Kitten (also tracked as UNC1549, Smoke Sandstrom, and Nimbus Manticore) is targeting developers and tech specialists in the aviation, aerospace, and financial sectors with fake job offers on LinkedIn and other platforms. Candidates are sent “coding tests” that secretly deliver previously unseen malware families, NodeRabbit and PollCat, disguised as programming assignments. NodeRabbit is a cross platform remote-access trojan (RAT) for Windows, Linux, and macOS that gathers system and user info, manipulates files, and executes commands, giving attackers full remote access. PollCat similarly provides persistent access and can drop additional payloads. Tests are time pressured and sometimes ban AI assistants, likely to discourage tools that might flag the malicious code. Mirage Kitten also routes traffic through legitimate Azure and Cloudflare infrastructure, sometimes embedding the victim organization’s name in Azure subdomains to make control and command (C2) traffic look like normal corporate activity. Active since at least 2022, the group continues to focus on targets in Africa and the Middle East using recruiter impersonation and fake job lures.