SECURITY Signal 56
Mirage Kitten reportedly deploys Node.js and JavaScript RATs against aviation and FinTech in Middle East and Africa
↗
A threat group has added Node.js and JavaScript remote-access trojans to its toolkit, delivered via trojanised coding-challenge archives on job platforms.
Engineers in aviation and FinTech sectors across the region are now exposed to cross-platform malware that runs on the same runtime they use daily. The shift to interpreted languages lowers the barrier for defenders to analyse the payloads, but also lowers the barrier for the attackers to iterate and evade detection.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
NodeRabbit and PollCat are two new RAT families written in Node.js and JavaScript respectively, both delivered through fake coding challenges.
The malware targets Windows, Linux, and macOS, and is distributed via spear-phishing on LinkedIn and other job-search platforms.
Mirage Kitten historically used compiled malware; the switch to interpreted languages is the first publicly documented instance for this group.
THE READ
What the cluster adds up to.
Mirage Kitten has expanded its arsenal with two previously undocumented remote-access trojans: NodeRabbit (Node.js) and PollCat (JavaScript). Both are cross-platform, running on Windows, Linux, and macOS. The malware is delivered through trojanised coding-challenge archives, which are hosted on legitimate cloud infrastructure and distributed via spear-phishing messages on job-search platforms. This delivery method exploits the trust engineers place in technical assessments during hiring processes.
The initial access vector relies on fake recruiter accounts contacting targets on platforms like LinkedIn. Victims are pressured to download and execute a project archive, which contains a malicious npm package. The package is bundled directly in the archive’s node_modules directory, avoiding the need for publication on the npm registry. Once imported, the package silently launches the implant as a detached background process, making detection harder during casual code review.
NodeRabbit and PollCat represent a shift from Mirage Kitten’s traditional use of compiled malware (C, C++, Go) to interpreted languages. This change lowers the technical barrier for both attackers and defenders. For attackers, it simplifies cross-platform development and rapid iteration. For defenders, it makes static and dynamic analysis more accessible, as the malware runs in the same runtime environment used by many engineers. However, the use of obfuscation in PollCat complicates analysis efforts.
The malware’s infrastructure leverages legitimate cloud services, such as Amazon S3, to host trojanised archives. This tactic blends malicious activity with normal traffic, making it harder to block without disrupting legitimate operations. The campaign’s focus on aviation and FinTech sectors in the Middle East and Africa suggests a strategic targeting of industries with high-value intellectual property and financial data. The use of job-search platforms for distribution indicates a calculated effort to exploit the urgency and trust associated with hiring processes.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER