{"id":73,"date":"2026-09-10T07:30:26","date_gmt":"2026-09-10T07:30:26","guid":{"rendered":"https:\/\/cyberfrogsecurity.com\/blog\/?p=73"},"modified":"2026-09-10T07:30:26","modified_gmt":"2026-09-10T07:30:26","slug":"security-awareness-linkedin-job-offers","status":"publish","type":"post","link":"https:\/\/cyberfrogsecurity.com\/blog\/security-awareness-linkedin-job-offers\/","title":{"rendered":"Cyber Security Awareness: Fake LinkedIn Job Offers"},"content":{"rendered":"

Cyber Security Awareness<\/a> must now account for social engineering that happens outside traditional email. In a campaign reported by Kaspersky on September 1, 2026, the Iran-linked Mirage Kitten group used fake recruiter personas on LinkedIn<\/a> and other job platforms to target technology specialists with malicious coding challenges containing two previously undocumented remote access trojans, NodeRabbit and PollCat. The reported targeting included aviation, aerospace, and financial technology organizations in the Middle East and Africa.<\/p>\n

The campaign is a useful lesson for security teams because the lure does not initially look like a conventional phishing attempt. Instead, the attacker reportedly creates a credible professional context, establishes a recruitment conversation, and then introduces a technical assessment. For developers, downloading and reviewing code is a normal part of their work, making the request more difficult to identify as suspicious.<\/p>\n

\u201cThe incident highlights why effective awareness programs on phishing domain detection<\/a> must teach employees to verify unusual requests, recognize social\u2011engineering tactics, and report suspicious activity \u2014 rather than just memorize common phishing indicators.<\/p>\n

What Happened in the Fake LinkedIn Job Campaign?<\/h2>\n

Kaspersky reported that Mirage Kitten, also tracked in reporting as Nimbus Manticore, approached software engineers through LinkedIn and other job-search platforms while posing as technology-company recruiters. The targets were reportedly offered employment opportunities and subsequently asked to complete coding assessments.<\/p>\n

The assessments contained malicious components associated with NodeRabbit and PollCat. Kaspersky identified NodeRabbit as a Node.js-based remote access trojan and PollCat as a JavaScript-based RAT. Both were designed to operate across Windows, Linux, and macOS environments, making the campaign particularly relevant to developers working with mixed operating systems.<\/p>\n

Kaspersky reported sightings involving Afghanistan, Egypt, and Ethiopia, with additional malware detections in several other countries. The company assessed the activity as targeting aviation and fintech sectors across the Middle East and Africa.<\/p>\n

These findings establish a reported malware campaign and targeted recruitment activity. They do not mean every person who received a suspicious LinkedIn message was compromised, and they do not establish that LinkedIn itself was breached.<\/p>\n

Why This Campaign Matters for Cyber Security Awareness<\/h2>\n

The most important lesson is behavioral. Employees are trained to be suspicious of unexpected attachments and questionable email links, but a fake job offer can create a very different psychological context.<\/p>\n

A person may expect recruiters to contact them through LinkedIn. A software developer may reasonably expect a coding assessment. A project archive may look like a normal technical assignment. The attacker therefore attempts to make the dangerous action appear consistent with the victim’s professional responsibilities.<\/p>\n

That makes Cyber Security Awareness particularly important for employees who regularly handle code, repositories, development tools, cloud services, or privileged systems.<\/p>\n

Awareness training should teach people to pause when an otherwise legitimate workflow contains an unusual security decision. The relevant question is not simply, “Does this message look suspicious?” It is also, “Does this request make sense, and can I independently verify it?”<\/p>\n

How Attackers Exploit Trust in Recruitment<\/h2>\n

The reported campaign combines several familiar social-engineering principles.<\/p>\n

Authority:<\/strong> The attacker reportedly presents themselves as a recruiter representing a recognizable technology company or professional opportunity.<\/p>\n

Familiarity:<\/strong> LinkedIn and job platforms are normal environments for employment discussions, which can reduce suspicion.<\/p>\n

Relevance:<\/strong> A coding challenge is directly connected to the target’s professional skills.<\/p>\n

Urgency:<\/strong> Reporting on the campaign indicates that some assessments were presented with short completion windows, increasing pressure to act quickly.<\/p>\n

Curiosity and opportunity:<\/strong> A potentially attractive job can encourage a person to prioritize the opportunity before carefully assessing the security implications.<\/p>\n

None of these factors means an employee is careless. They demonstrate why social engineering is fundamentally about manipulating context and decision-making.<\/p>\n

Security awareness programs should therefore teach verification behaviors rather than simply telling employees to distrust unfamiliar messages.<\/p>\n

What Should Developers Watch for in Job Offers?<\/h2>\n

Developers need security awareness guidance that reflects their actual workflows.<\/p>\n

Warning signs can include:<\/p>\n