Mirage Kitten Targets Developers with Sophisticated Malware Campaign
In a concerning development, the Iranian-linked cyber threat actor known as Mirage Kitten has initiated a targeted attack on software developers by employing deceptive recruitment assessments. These assessments are designed to camouflage two newly identified remote access trojans (RATs): NodeRabbit and PollCat.
The campaign predominantly leverages recruitment impersonation across major job search platforms such as LinkedIn. This tactic involves presenting legitimate-looking Node.js projects and utilizing cloud-hosted ZIP archives to gain covert access to various developer endpoints running on Windows, Linux, and macOS systems. The malware distribution has been particularly directed at sectors including fintech, aviation, and aerospace, with telemetry data revealing targets across the Middle East and Africa. The malicious project archives have also been traced back to countries like India, Türkiye, Israel, Iraq, Germany, and Ireland, highlighting the international scope of this cyber attack.
The infection typically begins with a fraudulent recruiter reaching out to potential candidates, enticing them with a technical role and sending a time-sensitive coding challenge. Among the files distributed in this campaign is an archive labeled Front-Technical-Challenge.zip, which contains an innocuous-looking TaskFlow application built with popular frameworks such as Express, React, and Vite. The README included with this application instructs candidates to fix front-end defects while misleadingly asserting that the file server.js is safe and should remain unchanged. Such directives effectively divert scrutiny away from the compromised file.
Upon execution, the altered server.js file is embedded with a malicious payload, which imports a trojanized version of the colorized_terminal package. This package has been deliberately bundled locally in the node_modules directory instead of being retrieved from the npm registry. Consequently, once the unsuspecting victim runs the project, the malicious package triggers the NodeRabbit payload located at node_modules/.cache/.320697f1/index.js, allowing it to operate as a detached process. In some instances, other similarly weaponized packages labeled as pretty-log have been employed.
What makes this social engineering tactic particularly effective against developers is the appearance of legitimacy. The coding assessments necessitate routine setup steps like running npm install and executing the application while imposing artificial deadlines that discourage rigorous code reviews. The threat actor’s strategy combines psychological pressure with technical vulnerabilities to maintain stealth during the exploitation process.
Kaspersky researchers have highlighted that an AI-based or manual audit could have easily unmasked the suspicious package import, revealing the underlying threat. NodeRabbit, characterized as a Node.js-based RAT, is versatile enough to function across multiple operating systems, including Windows, Linux, and macOS. The RAT generates a unique identifier based on identifiable system attributes—such as hostname, username, operating system data, architecture, and MAC address—and establishes persistence using mechanisms native to different operating systems.
In the case of Windows, earlier variants of NodeRabbit have been known to disguise themselves within various system files, such as Microsoft Edge Update or Intel Driver & Support Assistant components. They achieve this by renaming the node.exe binary and pairing it with a JavaScript payload, while also creating Registry Run keys or scheduled tasks to ensure persistence. Meanwhile, Linux-based variants employ cron job entries, and macOS counterparts set up LaunchAgents for similar purposes.
The implant crafted by this campaign communicates with a command-and-control infrastructure hosted on Azure, utilizing encrypted JSON requests secured with AES-256-GCM encryption. Kaspersky’s investigative efforts first identified NodeRabbit operating on a victim’s system located in Afghanistan, followed by the detection of more sophisticated versions in Egypt and Ethiopia.
The operators of NodeRabbit possess extensive capabilities, including the ability to collect system and network information, enumerate processes, execute shell commands, and manipulate files and beacon intervals. They can even run arbitrary Node.js scripts signed off by the attackers. Subsequent builds of NodeRabbit have introduced features like proxy discovery, anti-analysis checks, and a targeted persistence mechanism masquerading as a fake Visual Studio Code extension named “GitHub Copilot Helper.”
In addition to NodeRabbit, Kaspersky has documented a second strain of malware known as PollCat. This obfuscated JavaScript RAT is served up through a separate React-based assessment named RankChallenge-react. The deception continues with this particular lure, which utilizes recruiter-provided, ephemeral one-time passcodes (OTP) and a strict one-hour completion window, initiating the malware’s background operation prior to the victim even entering the code.
Once registered, PollCat can perform a plethora of malicious actions, including hosting inventory audits, executing commands, reading and deleting files, and even transferring files in both directions. Its SYSTEM_CHECK routine allows it to inspect software and directories associated with leading security products, helping it evade detection.
Kaspersky has been able to link this campaign to Mirage Kitten due to several overlapping traits in PollCat and the previous Retrograde/MiniFast tools used by the group. By analyzing the command-and-control structure, default beacon timing, and shared operational methods, the researchers have established a high level of confidence in their attribution to Mirage Kitten.
This recent campaign signifies a notable shift for Mirage Kitten. Historically, they have mainly utilized native C, C++, and Go malware often delivered through DLL search-order hijacking. However, NodeRabbit and PollCat illustrate a strategic pivot towards employing tools that blend seamlessly into modern developer workflows, manipulating Node.js dependencies, JavaScript execution methods, IDE extensions, Git hooks, and cloud-hosted assessment files.
Thus, organizations should remain vigilant and consider unsolicited coding challenges as untrusted software. It is advisable to isolate assessments within disposable environments, scrutinize bundled dependencies prior to execution, and monitor for any unusual Node.js processes or new scheduled tasks. Furthermore, reviewing Git hooks and directories related to VS Code extensions can substantially enhance security posture against these threats. Kaspersky detects this nefarious activity as Trojan.JS.MirageKitten.*, solidifying the ongoing need for cybersecurity awareness and proactive measures in the tech industry.