/
← Voltar ao feed
high fintech aviation aerospace

Mirage Kitten deploys Node.js NodeRabbit RAT and JavaScript PollCat RAT via fake job coding challenges

1 fonte(s) · 1 atualização(ões) · publicado 01/09/2026 04:00 · coletado há 1 dia

Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S3. Victims were identified in the fintech, aviation and aerospace sectors in Egypt, Ethiopia and Afghanistan. Kaspersky attributes the activity to Mirage Kitten with high confidence, based on C2 protocol, beacon timing and command-set overlaps with the Retrograde/MiniFast native backdoor.

Technical Details

  • Delivery: The archive Front-Technical-Challenge.zip contains the TaskFlow app (Express/React/Vite). Its server.js imports a trojanized npm package, colorized_terminal or pretty-log (both v2.1.0), bundled in node_modules rather than published to npm. The package silently launches the implant node_modules/.cache/.320697f1/index.js as a detached process. The README discourages editing server.js and bans AI assistants.
  • NodeRabbit: There are three variants. All derive the agent ID from a SHA-256 hash of host data and encrypt C2 traffic with AES-256-GCM. C2 runs on Azure- and Cloudflare-hosted infrastructure.
    • Variant 1 uses a single-instance listener on 127.0.0.1:48739 and supports 11 commands.
    • Variant 2 adds anti-analysis checks (memory, CPU, uptime, usernames, tools), decoy HEAD requests to Google, Microsoft and Cloudflare, corporate proxy support (NTLM delegated to curl.exe), a host-specific listener port (41984–46983) and persistence masquerading as Intel Driver & Support Assistant.
    • Variant 3 has 23 commands, including agent:servers. It adds VS Code persistence through a fake "GitHub Copilot Helper" extension, which also tries to disable Workspace Trust. It also adds Git-hook persistence (post-merge and post-checkout, marker # shepherd-persist).
  • PollCat: This obfuscated JavaScript RAT arrives in the RankChallenge-react lure, which uses an OTP login to pressure victims. The OTP is validated against the attacker domain lifespotify[.]com, registered in June 2026. The implant starts via requireAuth.js and requireObjects.js, independent of the OTP. It registers with a host ID of 129--<hostname> and treats an HTTP 400 response as a successful handshake that returns a socketId. It then uses /gate/hello, /gate/fetch and /gate/submit, polling every 2 minutes with 5 seconds of jitter. It declares 22 commands (3 unimplemented), including EVAL_JS for arbitrary JavaScript execution and SYSTEM_CHECK, which enumerates processes, Outlook folders and 24 security-vendor directories.
  • Attribution: Similarities to Retrograde/MiniFast include the HTTP 400 handshake with socketId, the registration JSON format, GET /agent/poll versus /gate/fetch, identical timing defaults (120000 ms / 5000 ms / 60000 ms), shared command IDs (0xB0, 0xB1) and the proxy NTLM approach. The group's Azure Websites and Cloudflare-backed infrastructure is a known hallmark. Kaspersky found about 11 further infrastructure assets from the same patterns. ZIP lures were also submitted to a multi-scanner from India, Türkiye, Israel, Iraq, Germany and Ireland.

Remediation

  • Treat unsolicited recruiter coding challenges as hostile. Run them only in isolated sandboxes or VMs, never on corporate or developer workstations.
  • Review package.json and the node_modules contents of third-party projects for unpublished or unknown packages before running npm i or node.
  • Hunt for the listed IOCs, unexpected VS Code extensions, # shepherd-persist entries in Git hooks, and Node.js processes running from .cache directories.
  • Monitor Azure- and Cloudflare-hosted C2 traffic that mimics the organization's naming. Kaspersky detects the threat as Trojan.JS.MirageKitten.*.

Linha do tempo

  1. securelist.com ↗ · pub. 01/09/2026 04:00 · coletado 19/10 17:57 primeiro registro

    Mirage Kitten deploys Node.js NodeRabbit RAT and JavaScript PollCat RAT via fake job coding challenges

    ler a análise desta fonte

    Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S3. Victims were identified in the fintech, aviation and aerospace sectors in Egypt, Ethiopia and Afghanistan. Kaspersky attributes the activity to Mirage Kitten with high confidence, based on C2 protocol, beacon timing and command-set overlaps with the Retrograde/MiniFast native backdoor.

    Technical Details

    • Delivery: The archive Front-Technical-Challenge.zip contains the TaskFlow app (Express/React/Vite). Its server.js imports a trojanized npm package, colorized_terminal or pretty-log (both v2.1.0), bundled in node_modules rather than published to npm. The package silently launches the implant node_modules/.cache/.320697f1/index.js as a detached process. The README discourages editing server.js and bans AI assistants.
    • NodeRabbit: There are three variants. All derive the agent ID from a SHA-256 hash of host data and encrypt C2 traffic with AES-256-GCM. C2 runs on Azure- and Cloudflare-hosted infrastructure.
      • Variant 1 uses a single-instance listener on 127.0.0.1:48739 and supports 11 commands.
      • Variant 2 adds anti-analysis checks (memory, CPU, uptime, usernames, tools), decoy HEAD requests to Google, Microsoft and Cloudflare, corporate proxy support (NTLM delegated to curl.exe), a host-specific listener port (41984–46983) and persistence masquerading as Intel Driver & Support Assistant.
      • Variant 3 has 23 commands, including agent:servers. It adds VS Code persistence through a fake "GitHub Copilot Helper" extension, which also tries to disable Workspace Trust. It also adds Git-hook persistence (post-merge and post-checkout, marker # shepherd-persist).
    • PollCat: This obfuscated JavaScript RAT arrives in the RankChallenge-react lure, which uses an OTP login to pressure victims. The OTP is validated against the attacker domain lifespotify[.]com, registered in June 2026. The implant starts via requireAuth.js and requireObjects.js, independent of the OTP. It registers with a host ID of 129--<hostname> and treats an HTTP 400 response as a successful handshake that returns a socketId. It then uses /gate/hello, /gate/fetch and /gate/submit, polling every 2 minutes with 5 seconds of jitter. It declares 22 commands (3 unimplemented), including EVAL_JS for arbitrary JavaScript execution and SYSTEM_CHECK, which enumerates processes, Outlook folders and 24 security-vendor directories.
    • Attribution: Similarities to Retrograde/MiniFast include the HTTP 400 handshake with socketId, the registration JSON format, GET /agent/poll versus /gate/fetch, identical timing defaults (120000 ms / 5000 ms / 60000 ms), shared command IDs (0xB0, 0xB1) and the proxy NTLM approach. The group's Azure Websites and Cloudflare-backed infrastructure is a known hallmark. Kaspersky found about 11 further infrastructure assets from the same patterns. ZIP lures were also submitted to a multi-scanner from India, Türkiye, Israel, Iraq, Germany and Ireland.

    Remediation

    • Treat unsolicited recruiter coding challenges as hostile. Run them only in isolated sandboxes or VMs, never on corporate or developer workstations.
    • Review package.json and the node_modules contents of third-party projects for unpublished or unknown packages before running npm i or node.
    • Hunt for the listed IOCs, unexpected VS Code extensions, # shepherd-persist entries in Git hooks, and Node.js processes running from .cache directories.
    • Monitor Azure- and Cloudflare-hosted C2 traffic that mimics the organization's naming. Kaspersky detects the threat as Trojan.JS.MirageKitten.*.