Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Threat actors, identified as Mirage Kitten, deployed two new cross-platform Remote Access Trojans, NodeRabbit and PollCat, which are built using Node.js and JavaScript, marking a shift from their historical use of native malware written in C, C++, and Go. The malware was distributed via spear-phishing messages on platforms like LinkedIn, often embedding trojanized coding challenge archives to lure victims. The initial infection chain involved fake recruiter accounts contacting software engineers on job search platforms, pressuring them to download and run project files hosted on Amazon S3.
NodeRabbit served as the first variant, delivered via a package named `colorizedterminal`, while PollCat was distributed through a different package, `pretty-log`. NodeRabbit demonstrated sophisticated persistence mechanisms tailored for Windows, Linux, and macOS by manipulating system files, cron jobs, and LaunchAgents. It communicated with Command and Control servers using Azure-hosted domains and employed encrypted communication with AES-256-GCM. PollCat also established persistence across operating systems, utilizing scripts and scheduled tasks.
The overall campaign demonstrated a consistent use of shared infrastructure, relying on Azure Websites and Cloudflare-backed domains for C2, and consistently used trojanized coding challenges as the delivery vector, focusing operations in the Middle East and Africa, particularly within the FinTech and aviation sectors.

* A malware family named NodeRabbit was discovered in Afghanistan, Egypt, and Ethiopia.
* NodeRabbit is a cross-platform Remote Access Trojan (RAT) built with Node.js, targeting Windows, Linux, and macOS.
* NodeRabbit variants were delivered through spear-phishing messages on LinkedIn and job search platforms containing trojanized coding challenge archives.
* The initial infection involved downloading a project archive hosted on Amazon S3, which contained a TaskFlow application.
* The first NodeRabbit variant was associated with the `colorizedterminal` npm package.
* NodeRabbit uses host information to generate a unique agent identifier based on system details and binds a TCP listener on 127.0.0.1:48739.
* NodeRabbit communicated with C2 servers via Azure-hosted domains (e.g., plugplay.azurewebsites.net) using AES-256-GCM encryption for communication.
* PollCat is another undocumented malware family, also a cross-platform RAT written in obfuscated JavaScript, distributed via trojanized coding challenges using the `pretty-log` package.
* PollCat used distinct C2 endpoints and command structures compared to NodeRabbit.
* NodeRabbit introduced commands such as `proc:start`, `fs:write`, and persistence mechanisms specific to each OS.
* PollCat supports operations like file and process manipulation, including an `EVALJS` command to execute supplied JavaScript.
* Infrastructure involves Azure Websites and Cloudflare-backed domains for C2 communication.

The emergence of Node.js/JavaScript-based malware by Mirage Kitten represents a significant evolution in the threat group's operational methodology, shifting from native code manipulation (DLL hijacking) to cross-platform scripting. This shift suggests an emphasis on creating more portable, easily deployable payloads that leverage widely available development toolchains, potentially reducing the overhead associated with maintaining disparate native binaries across operating systems. The shared use of specific trojanized npm packages (`colorizedterminal` and `pretty-log`) and a consistent C2 infrastructure pattern across both families indicates a centralized development or deployment pipeline for these new implants.
The distinction between NodeRabbit and PollCat, while both serving the same goal as RATs, highlights differing tactical approaches to persistence and command execution. NodeRabbit focuses on deep system integration, exemplified by its ability to manipulate Windows PE subsystems and utilize developer workflows like VS Code extensions and Git hook injection for persistence. PollCat, conversely, demonstrates a focus on rapid initial establishment through application startup logic and unique C2 beaconing patterns that are structurally similar to other known C2 implementations. This implies the group adapts toolsets based on tactical needs—NodeRabbit for stealthy, persistent access, and PollCat for establishing an interactive, albeit functionally divergent, channel.
The pattern of leveraging coding challenges as a delivery mechanism remains consistent with historical TTPs, but the sophistication in the resulting artifacts—the use of high-level scripting languages—suggests an ongoing commitment to operational security that focuses on blending malicious activity within legitimate developer environments. The focus on FinTech and aviation sectors across the MENA region indicates strategic targeting aligned with geopolitical interests, while the infrastructure choice (Azure/Cloudflare) shows a reliance on cloud-native persistence for operational security against traditional network monitoring.
Bridge Questions:
How does the group's adoption of Node.js change their long-term strategy regarding the maintenance and updating of these implants versus traditional native backdoors?
What is the impact of this cross-platform approach on the operational scale and efficiency of Mirage Kitten’s campaigns compared to previous native malware deployments?
If threat actors continue to evolve tooling away from traditional compiled languages, what new classes of artifacts should defenders prioritize monitoring for in development environments?