Mirage Kitten ships Node.js RATs via fake coding challenges

Kaspersky's GReAT threat-research team says an APT it tracks as Mirage Kitten has built two previously undocumented remote-access trojans, NodeRabbit and PollCat, and is aiming them at aviation and FinTech organizations across the Middle East and Africa. The finding comes from a Securelist report published September 1 by researcher Omar Amin. This is vendor threat research rather than a government advisory, so the link to Mirage Kitten is Kaspersky's assessment, not a court-proven fact.

The tooling is the story

The detail that stands out is what the malware is written in. Kaspersky calls these RATs the first publicly documented case of Node.js and JavaScript malware from this group, which it says has historically leaned on native C, C++ and Go implants loaded through DLL search-order hijacking. Moving to Node.js buys the operators one runtime that runs the same code on Windows, Linux and macOS. NodeRabbit is that cross-platform Node.js RAT, first seen on a system in Afghanistan with more capable variants later found on machines in Egypt and Ethiopia; PollCat is a second RAT written in heavily obfuscated JavaScript.

Delivery rides the hiring pipeline

Delivery is the part defenders should internalize. The operators pose as recruiters on LinkedIn and other job platforms, then send a trojanized take-home coding challenge, in one case a front-end assignment archive hosted on Amazon S3 whose README steers the candidate to trust a supplied server file. Later waves lean on a malicious VS Code extension and a poisoned Git hook. There is no wormable exploit in this chain; the whole thing depends on a target downloading and running an assessment they were handed. It echoes a wider drift toward attacks that ride developer tooling, seen recently in malicious Packagist packages posing as iOS themes.

What to hunt for

For hunters, Kaspersky flags behaviors worth turning into detections. PollCat's command-and-control registration is deliberately odd: a successful check-in comes back as an HTTP 400 error carrying the polling schedule, which is the opposite of what most beacons expect and easy to skim past in logs. Several NodeRabbit variants phone home to command servers hosted on Microsoft's Azure App Service, the same style of trusted-cloud hosting seen in other recent intrusions such as the Azure-based data theft aimed at Fortune 500 firms.

On attribution, Kaspersky ties the campaign to Mirage Kitten with high confidence, citing structural overlap with the group's older native backdoors and a shared C2 handshake. It stops short of naming a sponsoring government in the material it summarizes, and the confirmed victims are the Middle East and Africa samples above; scattered multi-scanner uploads elsewhere are not proof of compromise. Read the geography as where the telemetry sits, not the campaign's outer limit.

The takeaway

The practical response is unglamorous: treat any unsolicited LinkedIn coding challenge as hostile until proven otherwise, run take-home assessments only in throwaway sandboxes, pin and review every npm dependency in candidate projects, and hunt for unexpected Node processes beaconing to azurewebsites.net hosts. The decision for a security team is to widen developer-laptop monitoring to cover recruiting, because this campaign turns a recruiter message and a normal-looking npm project into initial access, and your engineers are the ones being asked to run the code.