Mirage Kitten ships Node.js RATs via fake coding challenges

Kaspersky's GReAT team says an APT it tracks as Mirage Kitten has built two previously undocumented remote-access trojans, NodeRabbit and PollCat, and is aiming them at aviation and FinTech organizations across the Middle East and Africa. The finding comes from a Securelist report published September 1 by researcher Omar Amin. The Mirage Kitten link is Kaspersky's vendor assessment, not a government advisory or a court-proven fact.

Kaspersky calls these RATs the first publicly documented case of Node.js and JavaScript malware from this group, which it says has historically leaned on native C, C++ and Go implants loaded through DLL search-order hijacking. Moving to Node.js buys the operators one runtime that runs the same code on Windows, Linux and macOS. NodeRabbit is that cross-platform Node.js RAT, first seen on a system in Afghanistan, with more capable variants later found on machines in Egypt and Ethiopia. PollCat is a second RAT written in heavily obfuscated JavaScript.

The operators pose as recruiters on LinkedIn and other job platforms, then send a trojanized take-home coding challenge. In one case a front-end assignment archive hosted on Amazon S3 included a README that steers the candidate to trust a supplied server file. Later waves lean on a malicious VS Code extension and a poisoned Git hook. There is no wormable exploit in this chain: the whole thing depends on a target downloading and running an assessment they were handed, the same drift toward attacks that ride developer tooling recently seen in malicious Packagist packages posing as iOS themes.

PollCat's command-and-control registration is deliberately odd: a successful check-in comes back as an HTTP 400 error carrying the polling schedule, the opposite of what most beacons expect and easy to skim past in logs. Several NodeRabbit variants phone home to command servers hosted on Microsoft's Azure App Service, the same style of trusted-cloud hosting seen in Azure-based data theft aimed at Fortune 500 firms.

Kaspersky ties the campaign to Mirage Kitten with high confidence, citing structural overlap with the group's older native backdoors and a shared C2 handshake. It stops short of naming a sponsoring government in the material it summarizes. The confirmed victims are the Middle East and Africa samples above. Scattered multi-scanner uploads elsewhere are not proof of compromise, so the geography is where the telemetry sits, not the campaign's outer limit.

Some offers on this page may be paid placements or contain affiliate links.