Mirage Kitten Uses Fake Developer Job Tests to Deliver NodeRabbit and PollCat RATs

A new Mirage Kitten campaign is targeting developers through a familiar process: job applications and technical coding assessments.

Kaspersky researchers have identified two previously undocumented remote access trojans, NodeRabbit and PollCat, which the researchers attribute to Mirage Kitten with a high degree of confidence. Unlike the group's historically documented native malware, the new implants are built using Node.js and JavaScript and are designed to operate across Windows, Linux and macOS.

The campaign is particularly notable because the malware is not presented as an obvious malicious executable. Instead, it is hidden inside software-development projects distributed as technical challenges to prospective job candidates.

That approach puts the developer workstation, along with its source code, credentials, development tools and repositories, directly in the attack path.

Mirage Kitten Changes Its Malware Approach

Mirage Kitten has historically used native malware written in languages such as C, C++ and Go. Kaspersky says NodeRabbit and PollCat represent the first publicly documented use of Node.js and JavaScript-based malware by the group.

NodeRabbit is a cross-platform RAT built with Node.js. PollCat is another cross-platform RAT written in obfuscated JavaScript.

Both were delivered through trojanised coding challenge archives.

Kaspersky identified NodeRabbit samples on systems in Afghanistan, Egypt and Ethiopia. The broader campaign targeted organisations in the Middle East and Africa, with identified victims in the fintech, aviation and aerospace sectors.

The Initial Access Technique

According to Kaspersky, the campaign begins with fake recruiter accounts contacting potential victims through job-search platforms, including LinkedIn.

The attacker presents a job opportunity and asks the target to complete a technical assessment. The candidate then receives a link to a coding challenge hosted on cloud infrastructure.

One investigation started with an archive called Front-Technical-Challenge.zip.

The archive contained TaskFlow, a software engineering assessment built using Express, React and Vite. The accompanying README instructed the candidate to review the application and fix frontend defects.

The challenge also imposed a three-hour deadline and prohibited the use of AI assistants.

Kaspersky noted that an AI code-review assistant examining the project could potentially have flagged the suspicious import of an unknown npm package. This is an observation from the researchers, not evidence that AI tools would reliably detect the campaign.

The Malicious npm Package Hidden Inside the Project

The key infection mechanism was hidden inside the development project.

The server.js file imported a trojanised package named colorized_terminal version 2.1.0.

Rather than being downloaded from the public npm registry, the malicious package was bundled directly inside the archive's node_modules directory.

When imported, the package silently launched the NodeRabbit implant as a detached background process.

Kaspersky also identified another trojanised package, pretty-log, used by additional NodeRabbit variants. Both packages were pinned to version 2.1.0 in the samples analysed by the researchers.

This demonstrates why developers should not assume that a project is safe simply because its visible source code appears legitimate.

NodeRabbit: A Cross-Platform RAT

NodeRabbit is built with Node.js and targets three major desktop operating systems:

• Windows

• Linux

• macOS

The first identified variant establishes an agent identifier using host information and maintains a local TCP listener as a single-instance mechanism. Kaspersky observed operating-system-specific persistence mechanisms across the three platforms.

The first variant can communicate with command-and-control infrastructure and supports commands for collecting system information, listing processes, executing shell commands, reading and writing files, deleting files and directories, enumerating network configuration and executing Node.js scripts.

Its communications use encrypted request structures, with Kaspersky documenting AES-256-GCM protection for the C2 requests.

Three NodeRabbit Variants

Kaspersky identified three NodeRabbit variants with shared code lineage.

The second variant introduced additional checks designed to determine whether the infected system resembles an analysis environment. It can also inspect proxy configuration and use corporate proxy infrastructure when communicating with its C2 servers.

The third variant introduced further changes to its command set and persistence mechanisms.

Kaspersky documented 23 commands in that variant, including functionality for process management, drive enumeration, C2 configuration changes, Outlook data collection, VS Code persistence checks, repository discovery and Git hook injection.

Developers and Their Tools Become Part of the Attack Surface

One of the most significant aspects of the third NodeRabbit variant is its focus on common developer workflows.

Kaspersky documented a capability to install a malicious VS Code extension that appeared as "GitHub Copilot Helper" with an AI coding assistant-related description.

The extension attempted to start the installed payload as a detached Node.js process.

The malware also included a Git hook persistence mechanism.

It could search development locations for Git repositories and inject launchers into Git hooks such as post-merge and post-checkout. A later Git operation could then trigger the malicious launcher.

This is important because the attack can move beyond the initial coding challenge.

Once malware reaches a developer workstation, development tools and project workflows can potentially become additional persistence mechanisms.

PollCat: Another JavaScript-Based RAT

During the investigation, Kaspersky discovered a second malware family named PollCat.

PollCat was also distributed through a programming challenge.

The sample was hidden inside a React-based coding assessment called RankChallenge-react. Running the project triggered installation and execution of the local application, while malicious components could operate in the background.

The challenge included an OTP-based authentication process and time restrictions intended to create urgency for the target.

However, Kaspersky found that PollCat could begin its C2 registration and command polling while the application was loading, before the user entered the access code.

The authentication mechanism therefore formed part of the lure rather than serving as the malware's primary execution gate.

PollCat's Capabilities

Kaspersky documented a range of PollCat commands.

These include functionality for:

• Listing directories

• Moving files

• Executing shell commands

• Listing running processes

• Deleting files

• Transferring files

• Enumerating drives and mount points

• Terminating processes

• Creating directories

• Creating or extracting ZIP archives

• Running hidden processes

• Executing JavaScript supplied by the C2

• Collecting system and software information

• Adjusting polling and timing behaviour

The researchers also found that PollCat could inspect locations associated with user files, applications and Outlook data, as well as look for directories associated with a range of security software vendors.

Three of the 22 declared commands were not implemented in the analysed sample.

Cloud Infrastructure Used for Command and Control

Mirage Kitten's infrastructure also reflects the group's existing operational patterns.

Kaspersky found the use of Microsoft Azure Websites and Cloudflare-backed domains for command and control. The researchers noted that Azure subdomains can make malicious traffic harder to distinguish from legitimate organisational activity.

Kaspersky also identified additional infrastructure based on patterns found across the campaign.

The report says approximately 11 additional infrastructure assets were discovered through this analysis.

The use of legitimate cloud services does not by itself indicate malicious activity. The security concern comes from how threat actors combine those services with malware infrastructure and social engineering.

Who Was Targeted?

Kaspersky's telemetry identified victims in fintech, aviation and aerospace across Egypt, Ethiopia and Afghanistan.

The researchers also observed trojanised project archives containing NodeRabbit and PollCat being submitted to an online multi-scanner from several countries, including India, Türkiye, Israel, Iraq, Germany and Ireland.

The report therefore shows both confirmed victim telemetry and broader evidence of the malicious archives circulating beyond the specifically identified victims.

Why the Campaign Matters for Developers

The main lesson from the campaign is not that Node.js, JavaScript, React or VS Code are inherently unsafe.

The problem is that developers routinely execute third-party code as part of their normal work.

A technical assessment may require commands such as installing dependencies, starting a local development server or opening a project in an editor. Those actions can provide a natural execution path for malicious code if the project has been tampered with.

The Mirage Kitten campaign demonstrates how attackers can exploit that normal workflow.

For developers, several precautions are particularly relevant:

Treat coding challenges as untrusted code

A project received during recruitment should be treated with the same caution as an unfamiliar third-party repository.

The fact that it came from a recruiter or appears to represent a legitimate company does not establish that the archive is safe.

Inspect dependencies before execution

Developers should examine package.json, lock files, scripts and bundled dependencies before running unfamiliar projects.

Unexpected packages, locally bundled dependencies and unusual installation behaviour deserve additional scrutiny.

Avoid running assessments on primary workstations

Where possible, unfamiliar coding challenges should be executed in an isolated environment rather than on a machine containing sensitive source code, credentials, SSH keys, cloud tokens or production access.

Review editor extensions

VS Code extensions and other development tools should be treated as software components with their own security implications.

Organisations can benefit from controlling which extensions developers are permitted to install.

Monitor Git repositories and hooks

Unexpected modifications to .git/hooks or repository configuration should be investigated, particularly when they appear after executing an unfamiliar project.

Separate development privileges

A developer machine should not automatically have unrestricted access to production environments, sensitive cloud resources or high-value credentials.

Segmentation can reduce the potential impact if a workstation is compromised.

The Broader Industry Shift

The announcement highlights a broader industry shift toward attacks that target developer workflows rather than only traditional applications or endpoints.

Developers are attractive targets because their workstations often sit at the intersection of source code, package ecosystems, cloud services, identity systems and internal infrastructure.

The Mirage Kitten campaign shows how a threat actor can combine social engineering with a software-development workflow to make malicious code appear relevant to the victim's professional responsibilities.

For enterprises, this could mean that developer security needs to extend beyond endpoint protection. Recruitment workflows, coding assessments, package management, IDE extensions and repository integrity can all become relevant parts of the security model.

This does not mean every coding test represents a security threat. It means that organisations and developers should apply appropriate trust boundaries whenever unfamiliar code is downloaded and executed.

Mirage Kitten's Evolution

Kaspersky attributes the activity to Mirage Kitten with a high degree of confidence.

The researchers cite similarities between PollCat and the group's previously documented Retrograde/MiniFast malware, including C2 handshake logic, host registration, command retrieval, beacon timing and proxy authentication approaches.

The victimology and infrastructure patterns also align with the group's previously observed activity in the Middle East and Africa.

Kaspersky concludes that NodeRabbit and PollCat represent a notable evolution in Mirage Kitten's tooling.

The group has moved from its historically documented native malware toward Node.js and JavaScript implants that can operate across Windows, Linux and macOS while fitting naturally into developer environments.

What Developers Should Take Away

The campaign reinforces a simple security principle:

A legitimate-looking development project is still executable code.

Recruitment platforms, coding assessments, npm packages, IDE extensions and Git repositories are all useful productivity tools. They can also become attack surfaces when trust is misplaced.

The safest approach is to verify the source, inspect the project before execution, isolate unfamiliar code and minimise the privileges available to development machines.

For security teams, the campaign is another reminder that protecting developers requires visibility across both endpoint activity and the software-development lifecycle.