An Iran-linked cyberespionage group is targeting technology specialists in the aviation, aerospace and financial sectors with fake job offers designed to trick them into installing previously undocumented malware, according to new research.

The group, tracked by Russian cybersecurity firm Kaspersky as Mirage Kitten, has targeted developers and other specialists in Egypt, Ethiopia and Afghanistan through LinkedIn and other job platforms.

Researchers investigating the campaign uncovered two previously unknown malware families, dubbed NodeRabbit and PollCat. Both are disguised as programming assignments that victims are asked to complete as part of a purported hiring process.

NodeRabbit is a remote-access trojan capable of infecting Windows, Linux and macOS systems. Once installed, it allows attackers to collect information about the victim and their computer, create or modify files and execute additional commands, giving the hackers remote access to the compromised machine.

In a report published Tuesday, Kaspersky said it first discovered NodeRabbit on a system in Afghanistan and later identified variants on systems in Egypt and Ethiopia.

The attacks begin with fake recruiters contacting potential victims on job-search platforms with seemingly legitimate tech job offers. In one documented case, an attacker posing as a recruiter for an unnamed major technology company approached a software engineer and asked them to complete a technical assessment. The victim was directed to download a coding challenge hosted on Amazon's cloud storage service and encouraged to run the project immediately.