Mirage Kitten ships Node.js RATs through fake LinkedIn coding challenges

Kaspersky, while monitoring Mirage Kitten activity, uncovered a previously undocumented malware family it dubbed NodeRabbit, a cross-platform remote access trojan built with Node.js that targets Windows, Linux and macOS.

During the same investigation Kaspersky discovered a second previously undocumented family, PollCat, also a cross-platform RAT but written in obfuscated JavaScript and also distributed through trojanized coding challenge archives.

Kaspersky identified the first NodeRabbit sample on a system in Afghanistan, and threat hunting revealed two additional, more advanced variants, one on a system in Egypt and another on a system in Ethiopia.

The README also imposed a three-hour time limit and prohibited the use of AI assistants.

Mirage Kitten has historically relied on native malware written in languages such as C, C++ and Go, often deployed through DLL search-order hijacking; Kaspersky calls NodeRabbit and PollCat the first publicly documented use of Node.js- and JavaScript-based malware by this APT group.

The first NodeRabbit variant was concealed within the TaskFlow assessment and executed by the trojanized colorized_terminal package on the affected system in Afghanistan.

Kaspersky's report describes Mirage Kitten as targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set.

According to a publicly cited source, a threat actor posing as a talent acquisition specialist at a major technology company contacted a software engineer, advertised a job opening, sent a link to a coding challenge hosted on Amazon S3, and pressured the target to download and run the project immediately.

Kaspersky says the public post matches the delivery chain it reconstructed from its own telemetry: recruiter outreach on a job search platform, a coding challenge presented as a technical assessment, and a trojanized project archive hosted on legitimate cloud infrastructure.

PollCat has a substantially different structure from NodeRabbit, was delivered through a separate coding challenge lure, and Kaspersky says it will be analysed later in the same research.

Kaspersky notes that an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized.

The archive Front-Technical-Challenge.zip, MD5 1EA83E4E4592B01E4ACAB63EB867BEE5, was hosted in an Amazon S3 bucket at oracle-challenge.s3.us-east-1.amazonaws.com.

The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0.

The attackers bundled the trojanized package directly in the challenge archive's node_modules directory rather than publishing it to the npm registry.

When imported, the trojanized package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process.

Kaspersky's products detect this threat as Trojan.JS.MirageKitten.*

Because the trojanized packages were bundled in the archive and never published to the npm registry, there is no registry artifact for dependency scanners or registry takedowns to act on, leaving detection to the endpoint.

One of the three host countries where NodeRabbit variants were recovered sits outside the Middle East and Africa scope stated in Kaspersky's report title.

The README carried three separate instructions that each reduced the chance the candidate would inspect server.js: do not modify it, finish within three hours, and do not use AI assistants.