Kiran 
Iran-linked threat actor Mirage Kitten has rolled out two previously undocumented cross-platform trojans, NodeRabbit and PollCat, in a fresh espionage campaign targeting aviation and financial-technology organizations across the Middle East and Africa, according to new research from Kaspersky’s Securelist team.
Mirage Kitten has traditionally relied on native malware written in C, C++, and Go, typically deployed via DLL search-order hijacking.
The discovery of NodeRabbit and PollCat marks the group’s first confirmed pivot to Node.js and JavaScript-based implants, a shift that gives operators a single codebase capable of running across Windows, Linux, and macOS, blending more naturally into developer workstations.
Mirage Kitten Deploys NodeRabbit, PollCat Malware on Aviation
Kaspersky researchers first spotted the activity on a system in Afghanistan, before retrospective hunting uncovered more advanced variants in Egypt and Ethiopia.
The infection chain begins with fake recruiter personas contacting software engineers on LinkedIn and similar job platforms, luring them into “technical assessments.”
Victims download a ZIP archive, such as Front-Technical-Challenge.zip, hosted on an Amazon S3 bucket that contains a legitimate-looking React/Express project called TaskFlow.
The README explicitly instructs candidates not to touch server.js, conveniently steering attention away from the one file attackers tampered with. That file imports a trojanized npm package bundled locally rather than published to the registry, which silently launches the NodeRabbit implant as a detached background process.
NodeRabbit fingerprints hosts via a SHA-256 hash of system attributes, establishes OS-specific persistence disguised as Microsoft Edge or Intel Driver updates, and communicates over AES-256-GCM encrypted channels to Azure-hosted C2 infrastructure.
Across its three identified variants, the RAT’s command set grew from 11 to 23 functions, adding capabilities like Outlook email harvesting, fake VS Code extension installation, and Git-hook persistence that reactivates malware whenever a developer runs routine Git operations.
PollCat, distributed through a separate CTF-themed React challenge, uses an OTP-gated “login” as a pressure tactic; codes are said to expire every 30 seconds while the malware itself begins C2 registration before any code is even entered.
It supports 22 commands, including file exfiltration, JavaScript execution via the C2, and a systematic scan for 24 named security vendors’ folders on the victim machine.
Researchers attribute the campaign to Mirage Kitten with high confidence, citing structural overlaps between PollCat and the previously documented Retrograde/MiniFast backdoor, including identical beacon timing values (120-second polling, 5-second jitter, 60-second retry), matching HTTP 400-as-handshake logic, and shared but partially unimplemented command IDs like REQUEST_ELEVATION and PERSIST.
The group’s continued preference for Azure Websites and Cloudflare-backed domains, plus its shift from OnlyOffice-hosted lures to Amazon S3, further reinforces the link.
By moving to scripting languages, Mirage Kitten reduces detection friction across platforms while keeping its social-engineering playbook recruiter impersonation targeting engineers in critical sectors unchanged.
Kaspersky flagged victims in Egypt, Ethiopia, and Afghanistan, with related scanner submissions from India, Türkiye, Israel, Iraq, Germany, and Ireland, suggesting the campaign’s reach extends well beyond its confirmed targets.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
