APT Group Mirage Kitten Uses Trojanized Coding Challenges to Deploy Novel RATs
Written by AI from the linked story. Not reviewed by an editor. How this works
Mirage Kitten is leveraging spear-phishing campaigns disguised as legitimate coding challenges to deliver two previously unknown cross-platform remote access trojans, NodeRabbit and PollCat, targeting aviation and FinTech organizations across the Middle East and Africa. The use of trojanized archives exploits the trust professionals place in routine recruitment or skills-assessment workflows, making detection more difficult and social engineering more effective. The shift to Node.js and JavaScript-based malware broadens the attack surface to multiple operating systems, bypassing defenses tuned for traditional native malware signatures. This campaign highlights how advanced threat actors continuously evolve their tooling and delivery mechanisms to outpace organizational defenses and threat intelligence.
Tactical Insight
Immediate actions
- Block execution of scripting runtimes (Node.js, JavaScript engines) from untrusted or unsanctioned sources via application allowlisting.
- Implement email filtering rules to quarantine and inspect compressed archives and executable attachments, especially those mimicking coding challenge or recruitment materials.
- Issue an urgent advisory to staff in aviation and FinTech roles warning them not to execute unsolicited code archives or run coding exercises from unknown senders.
Long-term improvements
- Establish a formal vendor and recruitment workflow verification process to authenticate the source of any coding assessments or technical exercises before execution.
- Deploy endpoint detection and response (EDR) solutions capable of detecting anomalous Node.js or JavaScript process behavior and lateral movement.
- Conduct regular, role-specific phishing simulations targeting technical staff who are likely recipients of credential- or career-themed lures.
Detection measures
- Monitor network egress for outbound connections initiated by scripting runtimes (node.exe, wscript.exe) to unfamiliar or newly registered domains.
- Correlate SIEM alerts on archive extraction events followed immediately by script interpreter execution as a high-fidelity detection rule.
- Subscribe to threat intelligence feeds covering APT groups active in the Middle East and Africa to receive timely indicators of compromise for Mirage Kitten tooling.