Mirage Kitten Targets Developers With Cross-Platform RATs
Securelist details Mirage Kitten campaigns using NodeRabbit and PollCat backdoors in trojanized coding assessments aimed at aviation and FinTech.
Mirage Kitten has adapted its malware delivery and execution model without abandoning a familiar social-engineering approach. In research published by Securelist, Kaspersky researchers describe two previously undocumented remote access trojans (RATs), NodeRabbit and PollCat, used against organizations in the aviation, aerospace and FinTech sectors across the Middle East and Africa.
The campaign is notable for combining recruiter impersonation with software-development workflows. Instead of presenting a conventional executable, operators supplied what appeared to be a coding assessment: a project archive that candidates were instructed to install and run. The approach places the malicious activity inside a developer’s normal toolchain and extends the threat beyond Windows. NodeRabbit and PollCat are designed to operate across Windows, Linux and macOS environments, although some individual persistence and collection features are platform-specific.
The campaign begins with a job application
According to Securelist, the observed infection chain starts with contact from a fake recruiter on LinkedIn or another job-search platform. The prospective victim is invited to complete a technical challenge, often under time pressure. The project is hosted on legitimate cloud infrastructure and delivered as a ZIP archive, making the initial download less unusual than an attachment from an unknown sender.
One documented lure was a project called TaskFlow, built with Express, React and Vite. Its README directed the candidate to review the application and correct frontend defects, while stating that server.js was complete and should not be changed. Securelist found that this source file contained the altered code. The first line imported a trojanized package named colorized_terminal, version 2.1.0. The package was included directly in the archive’s node_modules directory rather than obtained from the public npm registry.
When the package was imported, it launched a concealed implant from a cache-like path as a detached background process. Securelist identified other challenges using a similarly modified package named pretty-log, also pinned to version 2.1.0. This is an important supply-chain characteristic of the lure: the visible application can appear to be a legitimate candidate exercise while the malicious dependency is embedded locally in the supplied project.
PollCat used a separate React coding challenge called RankChallenge-react. The project started a local application and attempted to open the challenge in the browser. The associated instructions required a short-lived, recruiter-provided one-time code and imposed a one-hour session window. Securelist reported that the application forwarded submitted codes to attacker-controlled infrastructure, but also found that PollCat started independently of the authentication flow. A failed code validation therefore did not prevent the RAT from registering and polling in the background.
NodeRabbit: a cross-platform Node.js backdoor
Securelist recovered three NodeRabbit variants from systems in Afghanistan, Egypt and Ethiopia. They shared code lineage but differed in execution, evasion, persistence and command-and-control configuration.
The first variant generated an agent identifier from host details, including the hostname, username, operating system version, architecture and MAC address. It hashed that information with SHA-256 and used the first 32 hexadecimal characters. It also opened a listener on 127.0.0.1:48739 as a single-instance check; failure to bind the port caused the sample to exit.
Persistence was adapted to each operating system. On Windows, the malware copied itself and a renamed Node.js executable into an Edge-update-looking directory and created a current-user Run entry. It modified the executable’s subsystem so that the process would not present a console window. On Linux, it used a configuration directory resembling a browser update location and an @reboot cron entry. On macOS, it created a LaunchAgent configured to run at login and remain active.
The first variant communicated over HTTPS with three Azure-hosted endpoints, using registration, task-polling and result-submission API paths. Requests were JSON objects encrypted with AES-256-GCM. Each request included a fresh initialization vector and authentication tag, along with a random value and timestamp. Securelist observed 11 supported commands, including host and network inventory, process listing, shell-command execution, directory operations, file reading and writing, file deletion, configurable sleep intervals and execution of supplied Node.js scripts.
Later variants add evasion and developer-focused persistence
The second NodeRabbit variant introduced checks for conditions associated with analysis environments. Securelist said it terminated when it found indicators such as limited memory, a low CPU count, short uptime, analyst-associated usernames or hostnames, or common analysis tools. Before exiting, it generated ordinary-looking HEAD requests to major public websites and did not contact its C2 servers. This behavior is a researcher interpretation of an apparent attempt to reduce suspicion; it should not be treated as proof of the operators’ intent.
This variant also implemented partial corporate-proxy support. It inspected environment variables and Windows proxy settings, including PAC and WinHTTP configuration, and attempted to tunnel HTTPS through HTTP CONNECT. It could retry with embedded basic-authentication details or use curl.exe for NTLM or Negotiate challenges. Proxy-discovery results were cached temporarily and refreshed when network-interface or IP information changed.
Its persistence names imitated Intel Driver & Support Assistant. Windows received a daily scheduled task, while Linux and macOS used cron or LaunchAgent mechanisms. The third variant retained much of this functionality but changed its API paths and C2 chain, which included Azure-hosted and Cloudflare-backed domains.
That variant expanded NodeRabbit’s command set to 23 observed commands. Additions included drive enumeration, process execution and termination, C2-server replacement, Outlook mailbox artifact collection, persistence checks, development-project discovery and two developer-centric persistence mechanisms.
The first was a counterfeit Visual Studio Code extension. Securelist observed an extension presented as “GitHub Copilot Helper,” with a description suggesting an AI coding assistant. It attempted to start the installed payload as a detached Node.js process and used publisher information copied from local metadata to appear credible, although the researchers noted that no signature or trusted status was copied.
The second mechanism modified Git repositories. NodeRabbit searched selected recent or common development locations and could append launchers to post-merge and post-checkout hooks. The implant would be relaunched when a later Git operation invoked those hooks, provided the referenced files remained available. These features make developer workstations and source-code directories relevant places for incident response.
PollCat uses a separate command and polling design
PollCat is written in obfuscated JavaScript and has a different internal structure from NodeRabbit. Securelist observed that it loaded during application startup, before the user completed the visible challenge. After a successful authentication request, the application could start another PollCat instance and trigger a persistence attempt.
Its persistence methods again varied by operating system. Windows used files under an application-data network-themed directory and a daily scheduled task. Linux and macOS used a hidden Node.js package location, npm installation steps and cron or LaunchAgent configuration. The names and paths were designed to resemble ordinary Node.js or system-support components.
PollCat registered through a /beacon request and expected an unusual HTTP 400 response containing a socket identifier and optional timing values. It then submitted host information, retrieved commands and returned results through separate endpoints. Securelist reported a default polling interval of two minutes with up to five seconds of jitter. Commands included directory and process operations, file transfer, archive handling, hidden process execution, JavaScript evaluation, system inventory and timing changes. Three declared commands were not implemented in the analyzed sample.
Its system-inventory function gathered process names and directory listings from common application, user, document and Outlook-related locations. It also searched for folders associated with numerous security vendors and listed matching root directories without recursively scanning the entire product tree. The resulting information was sent to the C2 infrastructure as JSON.
Infrastructure and attribution
Securelist observed Azure Websites and Cloudflare-backed domains across the malware families. The researchers noted that Azure subdomains can blend with legitimate enterprise traffic, and in some cases appeared to include names associated with targeted organizations. The infrastructure pattern is a confirmed observation; it does not mean every Azure-hosted service matching a similar naming style is malicious.
Kaspersky attributed the activity to Mirage Kitten with a high degree of confidence. The assessment was based on similarities with the group’s Retrograde/MiniFast native DLL backdoor, including the treatment of HTTP 400 as a successful handshake response, socket-based session establishment, host-registration structures, polling behavior, timing defaults, command identifiers and proxy-authentication design. Securelist also described the targeting as consistent with Mirage Kitten’s known focus on entities in Africa and the Middle East.
The reported victim telemetry covered FinTech, aviation and aerospace organizations in Egypt, Ethiopia and Afghanistan. Securelist also observed related archives submitted to a public multi-scanner from several other countries, but that observation does not establish successful compromise in those locations.
What organizations should do now
- Change the review standard for coding tests. Treat externally supplied development projects as untrusted software. Require isolated virtual machines or disposable workspaces, and do not run
npminstallation or project startup commands on privileged or production-connected endpoints. - Inspect dependencies and lockfiles. Review package imports, local
node_modulescontent and package versions before execution. A package present only inside an archive deserves additional scrutiny, particularly when the project instructions discourage examination of a specific source file. - Monitor developer persistence locations. Hunt for unexpected VS Code extensions, unfamiliar LaunchAgents, cron entries, scheduled tasks, current-user Run keys and Git hooks that launch Node.js or other detached processes.
- Review Node.js process behavior. Alert on development projects spawning background Node.js processes that persist after the application exits, execute temporary scripts, access broad user directories or make repeated outbound HTTPS requests.
- Inspect proxy and network telemetry. Look for unusual HTTP CONNECT behavior, repeated requests to Azure Websites or newly observed domains, and API paths associated with registration, polling and result submission. Domain matches should be investigated in context rather than blocked solely because they use cloud hosting.
- Use the supplied indicators carefully. Compare endpoint, DNS, proxy and email-security telemetry with the hashes and defanged domains listed below. Because Securelist states that additional indicators are available through its threat-intelligence service, the list should not be assumed to be exhaustive.
- Protect recruiting workflows. Verify recruiter identities and assessment links through an independent channel. Provide candidates with a sanctioned test environment and prohibit externally supplied projects from accessing corporate credentials, source repositories or sensitive data.
Selected indicators
Securelist reported the following file hashes:
CBAAF0900A13F28E380F49ADECEC932C1EA83E4E4592B01E4ACAB63EB867BEE5366515822D5AC1CC500711EF57A2E32ECF449F1992C2819E62AC44A0B06AC2E7E95A4366686E3F786EA3C056FAB5B0DADE5AF16A3757EF700B01DC34D67079AEBE086789568441D0D7E4679AEE51F566291AC3ABE73C5158E59A437B75D5F0AA795E053A990A1569FFDCB57F48F6D0850962F56D7EC69F4F2A0162DCBE22116BRankChallenge-react-6uJSX3-main.zipwas also identified by filename in the report.
Reported infrastructure includes oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com, plugplay[.]azurewebsites[.]net, rgbteller[.]azurewebsites[.]net, wslwebui[.]azurewebsites[.]net, visitfinancedentists[.]com, healthcomfsdpower[.]com, lifespotify[.]com, sahi-finance[.]com, gamebarapp[.]azurewebsites[.]net and gamebarappinformation[.]azurewebsites[.]net. These indicators are displayed in defanged form and should be handled through established security tooling.
Conclusion
NodeRabbit and PollCat show how a threat actor can combine familiar recruitment lures with cross-platform scripting malware and developer-specific persistence. The strongest defensive response is not limited to blocking domains: organizations should control how coding projects are executed, inspect local dependencies, monitor Node.js behavior and investigate persistence in development tools and repositories. Securelist’s high-confidence Mirage Kitten assessment also makes the campaign relevant to organizations in aviation, aerospace and FinTech across the Middle East and Africa, while the full scope of victimization and infrastructure remains unconfirmed beyond the telemetry described in the report.