Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

1. Executive summary

Kaspersky GReAT has documented a campaign of targeted cyber-espionage activity against the aviation, aerospace and FinTech sectors across the Middle East and Africa (confirmed victims in Egypt, Ethiopia and Afghanistan), delivered via fake recruiter personas on LinkedIn and other job platforms that pressure software engineers into downloading and running trojanized coding-challenge archives hosted on Amazon S3. The campaign introduces two previously undocumented cross-platform RAT families — NodeRabbit (Node.js) and PollCat (obfuscated JavaScript) — both targeting Windows, Linux and macOS, with full file, process and shell command capability, developer-workflow persistence (fake VS Code extension, Git hooks, scheduled tasks, cron, LaunchAgents), and C2 hosted on Azure Websites and Cloudflare-fronted domains that blend into legitimate corporate traffic. Kaspersky attributes the activity to Mirage Kitten with high confidence; however, Mirage Kitten has no MITRE ATT&CK profile in our verified reference data, so the attribution must be treated as unconfirmed for the purposes of this advisory. No CVE is involved — this is a social-engineering and malicious-code-delivery campaign, not a patchable vulnerability — so the primary exposure for EMEA financial services clients is developer and engineering staff being recruited or job-hunting on LinkedIn, and the risk of espionage-grade RATs establishing long-lived persistence on developer endpoints, including in WSL environments.

2. Regulatory framing

No other article in the regulatory reference is specifically engaged. We note that DORA Art. 19 (reporting of major incidents) would only be triggered by an actual confirmed incident at the client, which this advisory does not assert.

3. Technical analysis & attack chain

Confirmed attack chain (reconstructed from Kaspersky telemetry and a corroborating public account of the delivery chain)

1. A threat actor operating a fake recruiter persona (posing as a talent acquisition specialist at a major technology company) contacts a software engineer on LinkedIn or another job search platform and advertises a role requiring a technical assessment.
2. The target receives a link to a coding-challenge ZIP archive hosted on legitimate cloud infrastructure — Amazon S3 (observed bucket: oracle-challenge.s3[.]us-east-1.amazonaws[.]com) — and is pressured to download and run the project immediately. The lure README imposes a three-hour time limit and prohibits AI assistants, both of which suppress review of the malicious code.
3. The archive contains a plausible full-stack application (e.g. TaskFlow, built with Express, React and Vite). The README directs the candidate to fix frontend defects and asserts that server.js is bug-free and must not be modified — steering attention away from the only altered file.
4. The first line of server.js imports a trojanized npm package — colorized_terminal or pretty-log, both pinned to version 2.1.0 — bundled directly in the archive's node_modules directory rather than published to the npm registry. On import, the package launches the implant from node_modules/.cache/.320697f1/index.js as a detached background process.
5. The implant (NodeRabbit or PollCat) establishes per-OS persistence and begins encrypted C2 communication with Azure-hosted and Cloudflare-fronted infrastructure.

NodeRabbit — technical detail. Cross-platform Node.js RAT, three variants with shared code lineage, each recovered from a system in a different country (Afghanistan, Egypt, Ethiopia).

• Agent ID: SHA-256 hash of hostname, username, OS version, architecture and MAC address, truncated to the first 32 hex characters.
• Single-instance: Variant 1 binds a TCP listener to 127.0.0.1:48739; if the bind fails it exits silently. Variant 2 derives a host-specific port from the agent ID: 41984 + (value mod 5000) where value is the first four hex characters of the identifier interpreted as an integer (port range 41984–46983).
• Variant 1 persistence: Windows — copies itself to %APPDATA%\Microsoft\EdgeUpdate\msedge_update.js, clones local node.exe to nodew.exe in the same folder and patches its PE subsystem from Console to Windows GUI to suppress the console window, then creates HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate executing nodew.exe msedge_update.js. Linux — copies to ~/.config/microsoft-edge-update/msedge_update.js with an @reboot cron entry. macOS — copies to ~/.config/microsoft-edge-update, creates ~/Library/LaunchAgents/com.microsoft.edgeupdate.plist with RunAtLoad and KeepAlive, and attempts to load it.
• Variant 2 persistence: masquerades as Intel Driver & Support Assistant. Windows — copies to %LOCALAPPDATA%\Intel\DSA\idriver_support.js, copies node.exe to IntelDSA.exe with the same PE Console→GUI subsystem patch, and creates a scheduled task named IntelDriverSupportUpdate running daily at 10:00. Linux — ~/.config/intel-dsa/idriver_support.js plus @reboot cron. macOS — ~/Library/Application Support/Intel DSA/idriver_support.js with LaunchAgent com.intel.dsa.helper (RunAtLoad, KeepAlive).
• Variant 2 anti-analysis: terminates if it detects limited system memory, low CPU count, short uptime, analyst-associated usernames/hostnames, or common analysis tools; before exiting it emits benign HEAD requests to www.google.com, www.microsoft.com and www.cloudflare.com and never contacts C2.
• Variant 2 proxy awareness: checks HTTP(S) proxy environment variables, Windows Internet Settings including explicit PAC URL, and WinHTTP configuration; tunnels HTTPS C2 through HTTP CONNECT; retries with URL-embedded basic credentials; finally delegates NTLM/Negotiate challenges to curl.exe --proxy-anyauth --proxy-user using the victim's logon session. Proxy-discovery results are cached for five minutes and invalidated on network-interface or IP change.
• Variant 1 C2: three Azure-hosted addresses with failover — plugplay.azurewebsites[.]net, Rgbteller.azurewebsites[.]net, Wslwebui.azurewebsites[.]net — using POST /api/rabbit/checkin (register), POST /api/rabbit/task (poll), POST /api/rabbit/result (submit).
• C2 cryptography: request objects serialised as JSON, wrapped with AES-256-GCM; the AES key is the SHA-256 digest of an ASCII seed embedded in the agent; fresh 12-byte IV and 16-byte authentication tag per request. Wire format: { "d": "base64(IV || ciphertext || authentication_tag)", "_r": "8 hexadecimal characters", "_t": "epoch timestamp" }. C2 responses use the same structure and may carry a command.
• Variant 1 commands (11): sys:info, proc:list, proc:start (arbitrary shell command), fs:list, fs:read (chunked, Base64), fs:write (Base64, chosen file offset), fs:delete, fs:mkdir, net:config, agent:sleep, script:exec (writes a Base64 Node.js script to a randomly named .tmp file, executes, deletes).
• Variant 3 (Ethiopia): launched via pretty-log; C2 chain of Azure- and Cloudflare-hosted domains — visitfinancedentists[.]com, kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net, healthcomfsdpower[.]com — with new endpoints POST /sdk/v2/ready, POST /sdk/v2/config, POST /sdk/v2/events. Persistence: Windows — attempts ProgramData (with /ru SYSTEM /rl highest if it can list C:\Windows\System32\config) or LocalAppData fallback, build-specific daily 10:00 task; macOS — ~/Library/Application Support with RunAtLoad/KeepAlive LaunchAgent; Linux — ~/.local/share with @reboot cron (skipped if crontab -l fails); WSL — reuses the Linux copy, writes launcher.vbs under the Windows user profile and creates a daily 10:00 Windows task relaunching via wscript.exe and wsl.exe. Retains the original 11 commands and adds 12, including outlook:emails (harvest account addresses from Outlook OST/PST artifacts), agent:servers (replace in-memory C2 list, optionally persisted to .sv.json), agent:getchain, proc:exec, proc:kill, fs:drives, and the developer-workflow persistence set below.
• Variant 3 developer-workflow persistence: persist:vscode creates a fake VS Code extension displayed as "GitHub Copilot Helper" with description "AI coding assistant helper service" and activation event onStartupFinished; its extension.js starts the installed payload as a detached Node.js process, borrowing a trusted publisher name from local extension metadata or a trustedPublishers value in state.vscdb (no signature or trusted status actually copied); it also attempts to disable VS Code Workspace Trust and, on Windows, falls back to a current-user Run registry key if the extension directory is missing. persist:projects:scan checks recent VS Code workspace paths and the first 60 immediate children of common locations such as ~/projects and ~/source (max 20 repositories returned); persist:project:inject appends a marked launcher to .git/hooks/post-merge and .git/hooks/post-checkout, with marker # shepherd-persist; followed by a line that starts the installed payload with Node in the background. persist:check audits selected VS Code, scheduled-task and Run-key persistence indicators; persist:vscode:remove and persist:project:remove clean up.

PollCat — technical detail. Cross-platform RAT in obfuscated JavaScript, delivered via a separate lure: RankChallenge-react, a React code-fixing challenge presented as a time-limited assessment. Running the project invokes npm i && node index.js.

• Lure mechanics: the project uses CTF terminology throughout (root package named ctf-server, backend prints "CTF server running", ctf-* storage keys, tutorial references path/to/ctf) — Kaspersky assesses this as consistent with an AI-assisted or template-generated project into which the attacker later inserted malicious components. The bundled PDF tutorial instructs the target to click Continue, enter a six-digit OTP supplied by the "recruiter" (single-use, expiring, claimed to rotate every 30 seconds) and complete the challenge within a one-hour session. The bundled .env contains the JWT signing secret, OTP service URL and OTP client ID. Submitted codes are forwarded to an attacker-managed domain registered in late June 2026: https://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate.
• Execution independent of OTP: at application startup, app.js loads requireAuth.js, which imports and immediately starts the malicious requireObjects.js. PollCat begins C2 registration and command polling before the user enters any access code; a failed OTP leaves PollCat running in the background. A successful OTP validation issues a JWT, spawns an additional PollCat worker, and triggers persistence on the first authenticated request to the protected middleware.
• Persistence: Windows — writes package.json and requireObject.js to %APPDATA%\Microsoft\Network, runs npm install, creates a daily 09:00 task named NetSync_<username> running the worker with Node.js. Linux — writes the worker to ~/.node_packages, runs npm i, appends a daily 09:00 cron line and an @reboot line. macOS — same ~/.node_packages copy and cron path, plus ~/Library/LaunchAgents/com.harsh.requireobject.plist with RunAtLoad and a daily 09:00 trigger.
• C2: host identified as 129--<hostname>; iterates sahi-finance[.]com, GamebarAppinformation[.]azurewebsites[.]net, GamebarApp[.]azurewebsites[.]net until registration succeeds. Registration: POST /beacon with JSON body {"clientId":"<client-id>","type":"poll","pcName":"<hostname>","userName":"<username>"}. Unusually, a successful registration is signalled by an HTTP 400 response containing {"socketId":"<socket-id>","pollInterval":<ms>,"jitterTime":<ms>}; the socketId is stored and used as the session token. Subsequent traffic: POST /gate/hello (host, user, domain, OS, privilege level), GET /gate/fetch?token=<socketId> (poll), POST /gate/submit (Base64-encoded results), GET /vault/<uuid> (retrieve hosted file to victim), PUT /vault/push/ (upload local file or chunk to C2), POST /gate/track (report chunk-upload progress). Default poll interval two minutes with up to five seconds jitter. Commands and results are stored as little-endian binary records carried as Base64 text.
• Commands (22 declared, three unimplemented): directory listing, move, shell execution, process listing, delete, C2-to-victim file download, victim-to-C2 upload, drive enumeration, process termination by PID, DLL load and exported-function call on Windows (RUNDLL), mkdir, ZIP create/extract, chunked upload, hidden background process, EVAL_JS (executes C2-supplied JavaScript with access to Node.js modules, files, processes, networking and child-process functions), SYSTEM_CHECK, SET_SLEEP_TIME, SET_IDLE_TIME, SET_JITTER_TIME; WS_DOWNLOAD, REQUEST_ELEVATION and PERSIST are defined but not implemented.
• Security-software inventory: SYSTEM_CHECK collects running process names and lists files/folders, and searches for folders matching 24 hardcoded security-vendor strings: 'Google', 'Microsoft', 'Palo Alto Networks', 'Cisco', 'VMware', 'Fortinet', 'Citrix', 'CheckPoint', 'Juniper Networks', 'LogMeIn', 'Sophos', 'Symantec', 'Trend Micro', 'McAfee', 'Kaspersky Lab', 'ESET', 'Bitdefender', 'Avast Software', 'CrowdStrike', 'SentinelOne', 'Malwarebytes', 'BraveSoftware', 'Tencent', 'Naver'. On a match it lists that folder's root contents (non-recursive) and sends the inventory as JSON to POST /api/system-details/result.

Infrastructure. Mirage Kitten continues to use Azure Websites (AS8075, registrar MarkMonitor Inc.) and Cloudflare-backed domains (AS13335, NameCheap/Dynadot) for C2. In some cases the actors incorporated the targeted organisation's name into the Azure subdomain, making C2 traffic resemble normal business traffic from an employee machine. Pattern analysis across C2 channels including msmanagementgrp[.]com and visitfinancedentists[.]com led Kaspersky to approximately 11 additional infrastructure assets (see §5).

Attribution and confidence caveats. Kaspersky attributes this activity to Mirage Kitten with high confidence, citing (per the related corpus-1 reporting on the group's broader toolset) code and behavioural overlap with the MiniFast/Retrograde toolset: both treat HTTP 400 as a successful handshake and parse a socketId from the body; near-identical host-registration request bodies (/gate/hello vs /agent/init); the same GET ...?token=<socketId> polling pattern; identical default poll interval 120,000 ms (0x1D4C0), jitter 5,000 ms (0x1388) and retry timeout 60,000 ms (0xEA60); the same unimplemented REQUEST_ELEVATION (0xB0) / PERSIST (0xB1) command slots; and the same proxy-aware C2 design delegating NTLM/Negotiate to curl.exe --proxy-anyauth --proxy-user versus a native WinHttp equivalent. However, Mirage Kitten has no MITRE ATT&CK profile in Adverse Trace's verified reference data, so we treat the attribution as unconfirmed. The entire technical dataset in this advisory is single-sourced (one vendor report, Kaspersky GReAT); The Record's coverage corroborates only the discovery geography (Afghanistan, then Egypt and Ethiopia), not the malware internals. Single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

1. Hunt for the lure archives. Search web/mail proxy logs, EDR download events and endpoint filesystems for the observed archive filenames: Front-Technical-Challenge.zip, FrontEnd-Task.zip, Task-FullStack.zip, fullstack-1536.zip, webapp76592.zip, webapp76531.zip, challenges-17831.zip, challenges-17832.zip, Project-1802.zip, Case-34234.zip, RankChallenge-react-6uJSX3-main.zip. Block and quarantine any hits; interview the recipient.
2. Block C2 infrastructure at the egress proxy and DNS resolver. All domains in §5 are candidate blocks; at minimum block the active C2 sets: plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, wslwebui.azurewebsites[.]net, visitfinancedentists[.]com, healthcomfsdpower[.]com, kyrasey-f8hfexa5cqamh7fk.westeurope-01.azurewebsites[.]net, sahi-finance[.]com, gamebarapp.azurewebsites[.]net, gamebarappinformation.azurewebsites[.]net, lifespotify[.]com, msmanagementgrp[.]com, msmanagementgrpmedia[.]com. Note: blocking *.azurewebsites.net wholesale will break legitimate Azure App Service traffic — block per-host and alert on any other *.azurewebsites.net host receiving POST-heavy beaconing patterns.
3. Sweep developer endpoints for the persistence artefacts. Windows: scheduled tasks named IntelDriverSupportUpdate, NetSync_<username>, and any build-specific daily 10:00 task; Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate; files %APPDATA%\Microsoft\EdgeUpdate\msedge_update.js and nodew.exe, %LOCALAPPDATA%\Intel\DSA\idriver_support.js and IntelDSA.exe, %APPDATA%\Microsoft\Network\requireObject.js and package.json. Linux/macOS: ~/.config/microsoft-edge-update/, ~/.config/intel-dsa/, ~/.local/share payload copies, ~/.node_packages, @reboot and daily 09:00/10:00 cron entries, LaunchAgents com.microsoft.edgeupdate.plist, com.intel.dsa.helper, com.harsh.requireobject.plist. WSL: launcher.vbs under the Windows user profile and any daily 10:00 task invoking wscript.exe with wsl.exe.
4. Sweep developer workflow persistence. VS Code extensions named "GitHub Copilot Helper" (description "AI coding assistant helper service", activation onStartupFinished); Git repositories for the marker # shepherd-persist; in .git/hooks/post-merge and .git/hooks/post-checkout; .sv.json files written by agent:servers.
5. Isolate any confirmed-infected host. Full reimage is recommended given script:exec/EVAL_JS arbitrary-code capability; at minimum remove all persistence entries above and rotate any credentials, tokens and SSH keys present on the host. outlook:emails harvesting means OST/PST-exposed mailbox addresses should be treated as enumerated.

P2 — within 72 hours

1. Alert on the single-instance listener behaviour. Variant 1 binds 127.0.0.1:48739; Variant 2 binds a host-specific port in 41984–46983. EDR/NetFlow rules for loopback listeners in these ranges on developer endpoints are cheap and high-signal.
2. Detect the C2 protocol shapes. PollCat: outbound POST to /beacon followed by an HTTP 400 response treated as success, then GET /gate/fetch?token=; NodeRabbit Variant 3: POST /sdk/v2/ready, /sdk/v2/config, /sdk/v2/events. NodeRabbit Variant 1/2: POST /api/rabbit/checkin, /api/rabbit/task, /api/rabbit/result. These URI paths on non-business hosts warrant alerting.
3. Brief engineering and recruitment-facing staff. The delivery vector is recruiter contact on LinkedIn/job platforms pressuring immediate download and execution of a coding challenge, with artificial time limits and prohibitions on AI assistants. Instruct developers never to run third-party coding-challenge projects on corporate endpoints; route any such request through security. Advise that AI code-review tooling would likely have flagged the malicious first-line import — the lure's explicit prohibition of AI assistants is itself an indicator.
4. Review npm supply-chain controls. The trojanized packages (colorized_terminal, pretty-log, both "2.1.0") were bundled in node_modules and never published to the npm registry — registry allow/deny lists alone will not catch this. Controls must cover execution of bundled, unpublished packages from untrusted archives.

P3 — within 7 days

1. Extend monitoring to Linux, macOS and WSL developer fleets. All three NodeRabbit variants and PollCat are cross-platform; Windows-only EDR coverage leaves the Linux/macOS persistence paths (cron, LaunchAgents, ~/.node_packages) invisible.
2. Audit scheduled tasks and cron for masquerading names. The group favours plausible update-themed names (IntelDriverSupportUpdate, NetSync_<username>, MicrosoftEdgeUpdate Run key, WindowsSecurityUpdate in the related MiniFast toolset). Baseline legitimate update tasks and alert on new ones with Node.js/wscript command lines.
3. Check proxy egress for curl.exe --proxy-anyauth --proxy-user invocations initiated by Node.js processes — the malware delegates NTLM/Negotiate proxy auth to curl using the victim's logon session, which is an anomalous parent-child pattern.
4. Review historical DNS/HTTP logs (from May 2026) against the full §5 domain list, including the 11 additional infrastructure assets registered May–July 2026, to establish whether any pre-existing exposure predates this reporting.

5. Indicators of compromise

All indicators are drawn from the Kaspersky GReAT report (single source). Confidence reflects corroboration only within that source.

Note on the S3 lure URL: the source presents the bucket hostname already defanged (oracle-challenge.s3[.]us-east-1.amazonaws[.]com); we reproduce it as given.

md5  1EA83E4E4592B01E4ACAB63EB867BEE5
md5  CBAAF0900A13F28E380F49ADECEC932C
md5  366515822D5AC1CC500711EF57A2E32E
md5  CF449F1992C2819E62AC44A0B06AC2E7
md5  E95A4366686E3F786EA3C056FAB5B0DA
md5  DE5AF16A3757EF700B01DC34D67079AE
md5  BE086789568441D0D7E4679AEE51F566
md5  E259C5EDF158AAC4CFE14F77DDD0B196
md5  291AC3ABE73C5158E59A437B75D5F0AA
md5  0962F56D7EC69F4F2A0162DCBE22116B
md5  795E053A990A1569FFDCB57F48F6D085
domain  oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com
domain  naturalapplication[.]azurewebsites[.]net
domain  retaildemo[.]azurewebsites[.]net
domain  tubitak[.]azurewebsites[.]net
domain  rgbteller[.]azurewebsites[.]net
domain  wslwebui[.]azurewebsites[.]net
domain  plugplay[.]azurewebsites[.]net
domain  crossdwm[.]azurewebsites[.]net
domain  wdisystem[.]azurewebsites[.]net
domain  wslmenus[.]azurewebsites[.]net
domain  dnshnsdev[.]azurewebsites[.]net
domain  hpjumpsrv[.]azurewebsites[.]net
domain  storview[.]azurewebsites[.]net
domain  healthcomfsdpower[.]com
domain  visitfinancedentists[.]com
domain  kyrasey-f8hfexa5cqamh7fk[.]westeurope-01[.]azurewebsites[.]net
domain  greenyjsgfd[.]azurewebsites[.]net
domain  helptellerbls[.]azurewebsites[.]net
domain  timedrv[.]azurewebsites[.]net
domain  userwellgtfs[.]azurewebsites[.]net
domain  hecowime-aqdphyd4bbdef6es[.]westeurope-01[.]azurewebsites[.]net
domain  msmanagementgrp[.]com
domain  msmanagementgrpmedia[.]com
domain  lifespotify[.]com
domain  gamebarapp[.]azurewebsites[.]net
domain  gamebarappinformation[.]azurewebsites[.]net
domain  sahi-finance[.]com
domain  healthful-hub[.]com
domain  neumedicahealthcare[.]com
domain  optimumhealthcredit[.]com
domain  healthfullyrecipes[.]com
domain  refreshhealthandwellness[.]com
domain  healthvitalitycare[.]com
domain  aceofspadesmanagement[.]com
domain  glmediaagency[.]com
domain  digimediaskill[.]com
domain  healthyweightplan[.]com
domain  mens-health-online[.]com
url  hxxps://oracle-challenge[.]s3[.]us-east-1[.]amazonaws[.]com/Front-Technical-Challenge.zip
url  hxxps://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate

Behavioural indicators (not machine-pivotable atomics; excluded from the block above):

6. Detection

The sources provide distinctive strings, file paths, registry keys, scheduled-task names and C2 URI paths that are artefacts of the threat itself, enabling the rules below.

rule NodeRabbit_PollCat_MirageKitten_Implant_Strings
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-01"
        reference = "https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/"
        description = "Detects NodeRabbit and PollCat RAT components by C2 endpoint paths, persistence artefact names and lure-specific strings observed in the Mirage Kitten coding-challenge campaign"
    strings:
        $ep_rabbit_checkin = "/api/rabbit/checkin"
        $ep_rabbit_task = "/api/rabbit/task"
        $ep_rabbit_result = "/api/rabbit/result"
        $ep_sdk_ready = "/sdk/v2/ready"
        $ep_sdk_config = "/sdk/v2/config"
        $ep_sdk_events = "/sdk/v2/events"
        $ep_beacon = "/beacon"
        $ep_gate_hello = "/gate/hello"
        $ep_gate_fetch = "/gate/fetch"
        $ep_gate_submit = "/gate/submit"
        $ep_vault_push = "/vault/push/"
        $ep_sysdetails = "/api/system-details/result"
        $cmd_sysinfo = "sys:info"
        $cmd_procstart = "proc:start"
        $cmd_scriptexec = "script:exec"
        $cmd_agent_servers = "agent:servers"
        $cmd_outlook = "outlook:emails"
        $cmd_persist_vscode = "persist:vscode"
        $cmd_project_inject = "persist:project:inject"
        $shepherd_marker = "# shepherd-persist;"
        $task_intel = "IntelDriverSupportUpdate"
        $task_netsync = "NetSync_"
        $runkey_edge = "MicrosoftEdgeUpdate"
        $file_msedge = "msedge_update.js"
        $file_idriver = "idriver_support.js"
        $file_requireobj = "requireObjects.js"
        $file_requireauth = "requireAuth.js"
        $file_svjson = ".sv.json"
        $file_launchervbs = "launcher.vbs"
        $pkg_colorized = "colorized_terminal"
        $pkg_prettylog = "pretty-log"
        $ext_copilot = "GitHub Copilot Helper"
        $ext_desc = "AI coding assistant helper service"
        $activation = "onStartupFinished"
        $plist_edge = "com.microsoft.edgeupdate.plist"
        $plist_intel = "com.intel.dsa.helper"
        $plist_harsh = "com.harsh.requireobject.plist"
        $json_d_field = "\"_r\""
        $json_t_field = "\"_t\""
    condition:
        uint16(0) == 0x4d5a or filesize < 5MB
        )
        and 5 of ($ep_*, $cmd_*, $pkg_*, $ext_*, $task_*, $file_*, $plist_*, $shepherd_marker, $runkey_edge, $activation, $json_*)
}

Note: the $ep_*, $cmd_*, $pkg_* and $json_* strings are protocol/behaviour artefacts of the malware's own code and C2 traffic; the $ext_*, $task_*, $file_*, $plist_*, $runkey_edge and $shepherd_marker strings are the exact persistence artefact names the malware creates. The condition requires five distinct artefact families to fire, limiting false positives on benign Node.js projects.

title: NodeRabbit/PollCat Persistence Artefacts - Mirage Kitten Coding Challenge Campaign
id: 7c2f1a34-9e58-4d21-b0aa-1f5e8c93d702
status: experimental
description: Detects scheduled-task creation, Run-key persistence and proxy-auth child processes used by NodeRabbit and PollCat RATs delivered via trojanized coding challenge archives (Kaspersky GReAT, 2026-09-01).
references:

    - https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/
author: Adverse Trace
date: 2026-09-01
tags:

    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    product: windows
    service: scheduled-task or process_creation
detection:
    selection_task_name:
        EventID: 4698
        TaskName:

            - 'IntelDriverSupportUpdate'
            - 'NetSync_*'
    selection_task_command:
        EventID: 4698

        |:

            - '*idriver_support.js*'
            - '*requireObject.js*'
            - '*msedge_update.js*'
            - '*launcher.vbs*'
    selection_run_key:
        EventID: 4657
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate'
    selection_curl_proxyauth:
        ParentImage|endswith: '\node.exe'
        Image|endswith: '\curl.exe'
        CommandLine|contains|all:

            - '--proxy-anyauth'
            - '--proxy-user'
    selection_wsl_relaunch:
        Image|endswith: '\wscript.exe'
        CommandLine|contains: 'launcher.vbs'
    condition: 1 of selection_*
falsepositives:

    - Legitimate Intel Driver & Support Assistant tasks (verify task action points to IntelDSA.exe with a .js argument before escalation)
    - Developer tooling invoking curl with proxy flags (verify parent is node.exe and flags match exactly)
level: high

7. Sources

• Kaspersky Securelist (GReAT) — "Mirage Kitten switches to Node.js and JavaScript malware" — https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244/ — 2026-09-01
• Kaspersky Securelist (GReAT) — "Mirage Kitten targets Middle East and Africa region with new malware" (related toolset: NightLedger, ArcBridge, BridgeHead; MiniFast/Retrograde overlap) — https://securelist.com/mirage-kitten-new-tools/120811/ — (corpus context)
• The Record (Recorded Future) — "Iranian cyber spies target aviation, fintech developers with new malware" — https://therecord.media/iranian-cyber-spies-target-aviation-fintech-new-malware — (corroborates discovery geography only)

8. Adverse Trace position

This is a capable, well-engineered espionage campaign aimed squarely at the developer population of FinTech, aviation and aerospace organisations in EMEA-adjacent regions, and its delivery vector — fake recruiter contact pressuring execution of a "coding challenge" — is directly transferable to any EMEA financial services client with engineers active on LinkedIn or job platforms; the absence of any CVE means patching is irrelevant and exposure is a function of people, process and endpoint telemetry on non-Windows platforms, which is where most financial-sector detection coverage is thinnest. Severity: high for clients with software engineering staff in or doing business with the Middle East and Africa; moderate elsewhere. Attribution to Mirage Kitten is unconfirmed in our verified reference data (no MITRE ATT&CK profile) and the technical dataset is single-sourced from Kaspersky GReAT — treat the IOC set as high-value but verify before enforcement action such as wholesale azurewebsites.net blocking. We will continue tracking this actor's infrastructure, monitor for a second Kaspersky instalment covering PollCat in depth (the report states further analysis is forthcoming), and update clients if the additional IoCs referenced as available through Kaspersky's commercial reporting surface or if independent corroboration of the attribution emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.