Kaspersky has uncovered a new malware campaign by the advanced persistent threat group Mirage Kitten, which is now using Node.js and JavaScript-based remote access trojans (RATs) to target aviation and FinTech sectors across the Middle East and Africa. The security firm identified three variants of a new malware family it calls NodeRabbit, found on systems in Afghanistan, Egypt, and Ethiopia, along with a second family dubbed PollCat.
The malware is delivered through trojanized coding challenge archives sent via spear-phishing messages on LinkedIn and other job search platforms. The attackers pose as recruiters and send a link to a challenge hosted on Amazon S3, pressuring the target to download and run it immediately. The archive, named Front-Technical-Challenge.zip, contains a project called TaskFlow, which includes a trojanized npm package that silently launches the implant.
NodeRabbit is a cross-platform RAT built with Node.js that targets Windows, Linux, and macOS. It binds a TCP listener to 127.0.0.1:48739 as a single-instance mechanism, and communicates with its command-and-control servers through three Azure-hosted endpoints. Kaspersky says the first variant it examined supported 11 commands, among them shell execution, file operations, and changes to the beacon interval.
A second, more advanced variant of NodeRabbit was found on a system in Egypt. It includes anti-analysis checks that terminate the malware if it detects limited system memory, a low CPU count, short uptime, or analysis tools. Before exiting, it generates benign HEAD requests to google.com, microsoft.com, and cloudflare.com, likely to appear less suspicious.
PollCat, the other new malware family, is also a cross-platform RAT but is written in obfuscated JavaScript and distributed through similar coding challenge lures. Kaspersky notes that Mirage Kitten has historically relied on native malware written in C, C++, and Go, often deployed through DLL search-order hijacking. The use of Node.js and JavaScript marks the first publicly documented shift for this group.
Kaspersky's products detect the threat as Trojan.JS.MirageKitten.*. The company says the campaign's delivery chain matches a publicly cited source where a threat actor posed as a talent acquisition specialist at a major technology company. The discovery follows Kaspersky's recent reporting on the threat landscape for industrial automation systems, which noted a decline in attacks on ICS computers, though Africa saw one of the higher regional percentages.
