Verticals Targeted: Fintech, Aviation, Aerospace
Regions Targeted: Middle East, Africa, Egypt, Ethiopia, Afghanistan
Related Families: NodeRabbit, PollCat
Executive Summary
Mirage Kitten conducted a cyberespionage campaign targeting software engineers through fake recruiter personas and trojanized coding challenges. The campaign delivers two previously undocumented cross-platform RATs, NodeRabbit and PollCat, capable of infecting Windows, Linux, and macOS systems. The malware provides command execution, file manipulation, reconnaissance, data theft, and persistent remote access. More advanced NodeRabbit variants also abuse Visual Studio Code extensions and Git hooks for persistence, demonstrating Mirage Kitten's increasing focus on compromising developer environments and exploiting trusted software development workflows.
Key Takeaways
- Iran-linked threat actor Mirage Kitten is targeting software engineers through fake recruiter personas and trojanized coding challenges designed to infect developer workstations with newly identified remote access trojans (RATs), NodeRabbit and PollCat.
- NodeRabbit and PollCat are cross-platform implants capable of operating across Windows, Linux, and macOS, marking Mirage Kitten's first publicly documented use of Node.js and JavaScript based malware.
- More advanced NodeRabbit variants introduce anti-analysis checks, corporate proxy support, expanded C2 capabilities, Outlook account discovery, and persistence through malicious Visual Studio Code extensions and Git hooks.
- The campaign targets aviation, aerospace, and fintech organizations across the Middle East and Africa and demonstrates Mirage Kitten's continued reliance on recruitment-themed social engineering, legitimate cloud infrastructure, and custom malware for cyber espionage.
The Campaign
Kaspersky discovered the activity while investigating Mirage Kitten infections and identified an initial NodeRabbit sample on a system in Afghanistan. Subsequent threat hunting uncovered more advanced NodeRabbit variants on systems in Egypt and Ethiopia, as well as a second malware family dubbed PollCat.
The infection chain begins with fake recruiter accounts contacting prospective targets through LinkedIn and other job-search platforms. Targets are presented with software engineering opportunities and instructed to complete technical assessments delivered as downloadable coding projects.
One observed archive, Front-Technical-Challenge.zip, contained an apparently legitimate Express, React, and Vite application called TaskFlow. The accompanying README instructed candidates to identify and repair frontend defects while explicitly stating that server.js was bug-free and should not be modified.
In reality, the first line of server.js imported a malicious npm package named colorized_terminal, version 2.1.0. Rather than publishing the package through the public npm registry, the attackers bundled it directly inside the archive's node_modules directory.
Importing the package silently launched NodeRabbit from node_modules/.cache/.320697f1/index.js. Later NodeRabbit variants were similarly launched through a trojanized package named pretty-log.
The lure also imposed a three-hour deadline and instructed candidates not to use AI assistants. Kaspersky noted that an AI code-review assistant could potentially have identified the suspicious dependency and warned the developer that the project was trojanized.
Kaspersky subsequently identified PollCat inside a separate React-based coding challenge. That lure used an attacker-controlled one-time password system and a one hour assessment window, creating additional urgency while allowing the operators to control access to the visible challenge. Importantly, PollCat does not depend on successful authentication. The malware can begin registering with its C2 infrastructure and polling for commands while the application is still loading.
NodeRabbit RAT
NodeRabbit is a cross-platform RAT developed using Node.js. Kaspersky identified three variants showing progressive development of the malware. The initial variant generates an agent identifier using host information, including the hostname, username, operating system version, architecture, and MAC address. It supports persistence across Windows, Linux, and macOS and communicates with Azure-hosted C2 infrastructure using encrypted API requests protected with AES-256-GCM.
The first variant supports 11 commands enabling operators to collect host and network information, enumerate running processes, execute arbitrary shell commands, manipulate files and directories, change beacon intervals, and execute attacker-supplied Node.js scripts.
NodeRabbit Variant 2
The second NodeRabbit variant introduces additional capabilities designed to improve execution inside enterprise environments. Before activating its primary functionality, the malware checks for characteristics commonly associated with malware-analysis systems, including low memory, limited CPU resources, short uptime, analyst-associated usernames or hostnames, and running analysis tools. If these conditions are detected, NodeRabbit generates benign HEAD requests to Google, Microsoft, and Cloudflare before terminating, without contacting its C2 infrastructure. Kaspersky assesses that this behavior is likely intended to make execution appear less suspicious before the malware exits.
Variant 2 also introduces corporate proxy awareness. It can inspect HTTP and HTTPS proxy environment variables, Windows Internet Settings, proxy auto-configuration URLs, and WinHTTP configuration. The malware supports HTTP CONNECT tunneling and can attempt Basic, NTLM, or Negotiate proxy authentication. This capability increases the malware's ability to establish C2 communications from enterprise environments in which outbound internet traffic is routed through corporate proxies.
NodeRabbit Variant 3
The third NodeRabbit variant expands the command set from 11 to 23 commands and introduces additional reconnaissance and persistence capabilities. New functionality includes drive and mounted volume enumeration, process execution and termination, dynamic replacement of the active C2 server list, Outlook account address discovery from OST and PST artifacts, persistence verification, Visual Studio Code extension persistence, development project discovery, and Git repository persistence. Variant 3 can also replace its active C2 infrastructure through the agent:servers command and attempt to persist the updated configuration to disk, providing operators with a mechanism to migrate compromised systems to new infrastructure.
One of NodeRabbit Variant 3's most notable capabilities is persistence through a malicious Visual Studio Code extension. When instructed through the persist:vscode command, NodeRabbit can create an extension masquerading as GitHub Copilot Helper, described as an AI coding assistant helper service, which activates after Visual Studio Code completes startup.
Its extension.js component attempts to launch the installed NodeRabbit payload as a detached Node.js process. To make the extension appear less suspicious, NodeRabbit can reuse a trusted publisher name found in locally installed extension metadata or Visual Studio Code's state.vscdb database. The malware does not reproduce the publisher's signature or trusted status. NodeRabbit also attempts to disable Visual Studio Code Workspace Trust and, on Windows, can attempt Run-key persistence even if the extension directory is unavailable.
Variant 3 can search recent Visual Studio Code workspace paths and common development directories for Git repositories. For a selected repository, the malware can inject a launcher into .git/hooks/post-merge and .git/hooks/post-checkout. The injected code attempts to relaunch NodeRabbit when a subsequent Git operation triggers one of those hooks, provided that the referenced Node executable and malware payload remain available. This technique turns normal developer Git activity into a potential execution trigger and illustrates how Mirage Kitten is abusing development environments themselves as persistence mechanisms.
PollCat RAT
PollCat is a separate cross-platform RAT written in obfuscated JavaScript and distributed through another trojanized coding challenge. Kaspersky identified PollCat inside RankChallenge-react, a React-based code-fixing exercise presented as a time-limited developer assessment. The project includes an OTP authentication system ostensibly required to access the challenge. However, PollCat starts independently of the authentication process. During startup, the application loads malicious components that initiate C2 registration and command polling before the victim enters an OTP. A failed OTP therefore prevents access to the protected challenge features but does not terminate PollCat.
PollCat establishes platform-specific persistence using scheduled tasks on Windows, cron entries on Linux, and cron and LaunchAgent mechanisms on macOS. The RAT declares 22 commands, three of which Kaspersky found to be unimplemented. Implemented functionality includes directory enumeration, file movement and deletion, shell command execution, process enumeration and termination, file transfer, drive and volume enumeration, DLL execution on Windows, ZIP archive operations, hidden process execution, arbitrary JavaScript execution, system inventory, and modification of beacon timing and jitter.
The EVAL_JS command is particularly powerful because attacker-provided JavaScript executes with access to Node.js modules and can interact with files, processes, child processes, and network resources. PollCat's SYSTEM_CHECK functionality inventories running processes and common filesystem locations and searches for directories associated with 24 security and technology vendors, including Microsoft, Palo Alto Networks, Cisco, Fortinet, CrowdStrike, SentinelOne, Sophos, Symantec, McAfee, Kaspersky, ESET, Bitdefender, and Malwarebytes.
C2 Infrastructure
Mirage Kitten continues to rely heavily on legitimate cloud infrastructure and Cloudflare-backed domains for C2 operations. Kaspersky identified numerous NodeRabbit C2 endpoints hosted on Microsoft Azure Websites. PollCat similarly uses Azure-hosted infrastructure alongside attacker-controlled domains. Kaspersky observed that the actors sometimes incorporated a targeted organization's name into Azure subdomains, potentially making malicious C2 communications resemble normal organizational traffic.
Kaspersky's latest infrastructure analysis additionally identified approximately 11 infrastructure assets attributed to Mirage Kitten based on patterns observed across its C2 channels. The combination of legitimate cloud services, fallback servers, Cloudflare-backed domains, and infrastructure designed to resemble legitimate traffic complicates detection strategies based primarily on domain reputation.
Targeting and Victimology
Kaspersky identified victims in Egypt, Ethiopia, and Afghanistan, with affected organizations operating in the fintech, aviation, and aerospace sectors. Kaspersky also observed submissions of ZIP archives containing trojanized NodeRabbit and PollCat projects to an online multi-scanner originating from India, Türkiye, Israel, Iraq, Germany, and Ireland.
These submissions indicate broader geographic exposure to the malicious archives but should not be treated as confirmation that organizations in each country were successfully compromised. The targeting is consistent with Mirage Kitten's broader interest in strategically important organizations across the Middle East, Africa, and surrounding regions. Software engineers represent particularly valuable targets because successful compromise may expose development resources, internal repositories, credentials, or other corporate systems accessible from the affected workstation.
Who Is Mirage Kitten?
Mirage Kitten is an Iran-linked cyberespionage group also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. Mandiant has tracked suspected UNC1549 activity since at least June 2022 and identified overlaps with Tortoiseshell and Smoke Sandstorm/BOHRIUM. Tortoiseshell has been publicly linked to Iran's Islamic Revolutionary Guard Corps (IRGC), but public reporting does not establish that every Mirage Kitten or UNC1549 operation is directly conducted by the IRGC.
The actor has historically targeted strategically significant organizations, particularly across the Middle East, with an emphasis on aerospace, aviation, defense, and related sectors. Mirage Kitten commonly uses recruitment-themed social engineering, fake employment opportunities, and legitimate cloud infrastructure to establish and maintain access.
Recent activity demonstrates continued expansion of the group's custom malware arsenal. Kaspersky documented the NightLedger backdoor and ArcBridge and BridgeHead tunneling tools in July 2026. NodeRabbit and PollCat now mark the group's first publicly documented use of Node.js and JavaScript based malware, extending its operations across Windows, Linux, and macOS while maintaining its established recruitment-focused tradecraft.
Analyst Commentary
NodeRabbit and PollCat appear to represent an evolution in Mirage Kitten's tooling rather than a change in the group's broader espionage objectives. The campaign retains familiar elements of the actor's tradecraft, including recruitment-themed social engineering, custom malware development, strategic targeting, and abuse of legitimate cloud infrastructure, while adapting those techniques specifically to modern software development environments.
That adaptation is particularly notable. Mirage Kitten is not simply targeting developers as another category of employee; it is exploiting the tools and behaviors inherent to development work. Technical assessments routinely require candidates to download unfamiliar source code, install dependencies, and execute applications. NodeRabbit extends that abuse further by establishing persistence through Visual Studio Code extensions and Git hooks, turning trusted development workflows into potential execution mechanisms.
NodeRabbit and PollCat also demonstrate why malicious code does not need to arrive as a conventional executable to pose a serious threat. Their activity is embedded within technologies that are commonplace on developer systems, including Node.js, npm packages, JavaScript, Visual Studio Code, and Git. Combined with C2 communications using legitimate cloud infrastructure, this can make malicious activity more difficult to distinguish from normal development and network behavior.
For emerging campaigns involving previously undocumented malware families, relying on the visibility of a single detection technology can create gaps. PolySwarm provides access to a marketplace of independent malware detection engines, allowing suspicious artifacts to be evaluated across multiple detection technologies and providing additional signals that can help analysts identify suspicious components and prioritize investigation. Defenders can use PolySwarm to analyze suspicious artifacts recovered from recruitment lures, downloaded coding challenges, bundled dependencies, JavaScript payloads, and related files. Multi-engine verdicts can help analysts compare detection results, identify artifacts warranting deeper analysis, and enrich threat intelligence workflows as adversaries increasingly exploit legitimate development frameworks and trusted workflows.
IOCs
PolySwarm has multiple samples associated with this activity.
123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7
307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00
Click here to view all samples of NodeRabbit in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
