Mirage Kitten Deploys NodeRabbit and PollCat Through Job Offer Lures

Summary

Iran-linked threat actor Mirage Kitten is running a cyberespionage campaign targeting software engineers through fake recruiter personas. The attackers distribute trojanized coding challenges that deliver two newly identified cross-platform RATs, NodeRabbit and PollCat. Both malware families abuse Node.js environments to establish persistence and remote access across Windows, Linux, and macOS systems.

Investigation

Kaspersky identified the activity after discovering a NodeRabbit sample in Afghanistan and later uncovering more advanced variants in Egypt and Ethiopia. The investigation revealed a sophisticated infection chain involving malicious npm packages embedded within legitimate-looking web application archives. Researchers also identified PollCat operating through a separate React-based coding challenge.

Mitigation

Organizations should enforce strict controls over third-party npm package dependencies and use AI-assisted code review tools to identify suspicious imports or behaviors. Developers should be trained to recognize social engineering attempts on professional networking platforms. Security teams should also monitor for unauthorized Visual Studio Code extensions and unexpected modifications to Git hooks.

Response

If malicious activity is detected, affected developer workstations should be isolated immediately to prevent lateral movement and further C2 communication. Responders should audit local node_modules directories, Git hooks, and VS Code extensions for unauthorized or suspicious files. Cloud infrastructure logs, particularly from Azure and Cloudflare, should also be reviewed for anomalous connections originating from developer environments.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully tricked a developer into running a malicious “coding challenge” repository. The developer executes a Node.js script intended to simulate a coding environment. However, the script contains the taskflow argument, which is part of the NodeRabbit RAT’s initialization routine. The goal is to establish a remote access foothold by masquerading as a legitimate development tool. The execution of node taskflow.js will produce the exact command-line telemetry required to trigger the rule.

• Regression Test Script:

  # Simulation script for NodeRabbit RAT Detection
  # This script creates a dummy javascript file and executes it using Node.js 
  # with the specific argument 'taskflow' to trigger the detection rule.
  
  $dummyFile = "challenge_setup.js"
  "console.log('Initializing coding challenge...');" | Out-File -FilePath $dummyFile -Encoding utf8
  
  Write-Host "[+] Simulating NodeRabbit RAT execution via taskflow argument..." -ForegroundColor Cyan
  
  # Triggering the detection: node <filename> <trigger_string>
  node $dummyFile taskflow
  
  Write-Host "[+] Simulation command executed." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup script to remove simulation artifacts
  Remove-Item -Path "challenge_setup.js" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete. Simulation artifacts removed." -ForegroundColor Yellow