"During recent threat research, we detected suspicious activity on a system in Afghanistan." — Kaspersky
Kaspersky's investigation uncovered two previously undocumented cross‑platform remote access trojans used in a targeted campaign against aviation and FinTech organizations across the Middle East and Africa. The implants — NodeRabbit (Node.js) and PollCat (obfuscated JavaScript) — were delivered inside trojanized coding‑challenge archives pushed to targets via recruiter personas on LinkedIn and other job search platforms, with lures hosted on legitimate cloud infrastructure.
NodeRabbit: three variants, one lineage
NodeRabbit is a Node.js remote access trojan recovered from systems in Afghanistan, Egypt, and Ethiopia. Kaspersky identified three variants that share a code lineage but differ in anti‑analysis, C2 configuration, and persistence.
- Variant 1 (Afghanistan): launched by a bundled trojanized npm package (colorized_terminal v2.1.0) inside a Front‑Technical‑Challenge.zip archive (MD5: 1EA83E4E4592B01E4ACAB63EB867BEE5). It bound a TCP listener to 127.0.0.1:48739 as a single‑instance guard, used OS‑specific persistence (examples: %APPDATA%\\Microsoft\\EdgeUpdate\\msedge_update.js and an HKCU Run key on Windows), and polled Azure‑hosted C2 endpoints such as plugplay.azurewebsites[.]net. Communications are JSON objects wrapped with AES‑256‑GCM using an AES key derived as the SHA‑256 digest of an embedded ASCII seed; each request includes a fresh 12‑byte IV and 16‑byte authentication tag.
- Variant 2 (Egypt): delivered via a trojanized pretty‑log package, it added anti‑analysis checks (low RAM/CPU, short uptime, analyst usernames/processes) and partial corporate proxy support — including Windows Internet Settings, PAC URLs, and WinHTTP delegation to curl.exe for NTLM/Negotiate. It enforces single‑instance with a host‑specific port: 41984 + (first four hex chars of the agent ID mod 5000). For persistence it impersonates Intel Driver & Support Assistant with per‑OS mechanisms (scheduled task IntelDriverSupportUpdate on Windows).
- Variant 3 (Ethiopia): retained prior functionality but introduced new C2 endpoints (including visitfinancedentists[.]com and healthcomfsdpower[.]com), expanded commands from 11 to 23 (examples: agent:servers to replace C2 list; persist:vscode to install a fake VS Code extension named "GitHub Copilot Helper"; and persist:project:inject to append a launcher to .git/hooks/post‑merge or post‑checkout marked with "# shepherd‑persist"), and new persistence tailored to developer workflows and WSL.
PollCat: a JavaScript RAT inside a React challenge
PollCat was found inside RankChallenge‑react, a time‑limited React assessment that required running npm i && node index.js. The archive used CTF‑style labels and an embedded OTP flow that could be controlled by the recruiter; the OTP validation endpoint pointed at an attacker‑controlled domain registered in late June‑2026: https://lifespotify[.]com/api/.../otp/validate.
PollCat starts independently of OTP entry and, once active, persists via OS‑specific methods (Windows: %APPDATA%\\Microsoft\\Network + daily task NetSync_; Linux/macOS: ~/.node_packages plus cron or LaunchAgents). It registers to C2 hosts including sahi‑finance[.]com and GamebarApp*.azurewebsites[.]net by POST /beacon and expects an unusual HTTP 400 response that carries a socketId and timing values. Default polling is every 120 seconds with up to 5,000 ms jitter.
PollCat exposes 22 declared commands (three unimplemented). Capabilities include file transfer, remote execution, EVAL_JS (execute JavaScript with full Node.js module and process access), and SYSTEM_CHECK, which inventories processes and searches developer and Outlook‑related paths and for folders named for 24 security vendors (examples: CrowdStrike, Kaspersky Lab, Microsoft, Trend Micro), listing matching folder roots for exfiltration.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDelivery and infrastructure: S3 lures, Azure and Cloudflare C2s
The initial access pattern replicated earlier Mirage Kitten tradecraft: fake recruiter outreach, pressure to run a coding assessment, and archives hosted on legitimate cloud services. Kaspersky traced a Front‑Technical‑Challenge.zip hosted at oracle‑challenge.s3[.]us‑east‑1.amazonaws[.]com and observed a shift from prior use of onlyoffice.com to Amazon S3 for hosting lures.
Command‑and‑control infrastructure relied heavily on Azure Websites and Cloudflare‑backed domains — a blend that can mimic legitimate enterprise traffic. Kaspersky enumerated multiple domains and registrars (e.g., NameCheap and MarkMonitor) and identified roughly 11 additional domains created between May and July 2026 linked to the same patterns (examples: healthful‑hub[.]com, neumedicahealthcare[.]com, visitfinancedentists[.]com).
Victims identified by telemetry were in FinTech, aviation and aerospace sectors located in Egypt, Ethiopia and Afghanistan; Kaspersky also observed submissions of the trojanized archives to public multi‑scanners from IPs in countries including India, Türkiye, Israel, Iraq, Germany, and Ireland.
What this means for FinTech, aviation and developer security teams
- FinTech and aviation enterprises: monitor for connections to the Azure/Cloudflare domains and the specific domains and file‑paths listed by Kaspersky; check for scheduled tasks and suspicious Node.js binaries in user profile locations and ProgramData.
- Developer security teams: validate coding‑challenge archives before execution, inspect bundled node_modules (look for unexpected packages such as colorized_terminal or pretty‑log bundled at version 2.1.0), and audit VS Code extension directories and Git hooks for unauthorized launchers marked with "# shepherd‑persist".
- Platform operators and hiring managers: be aware of fake recruiter personas delivered via LinkedIn and other job platforms; the lure’s use of expiring OTPs and countdowns is designed to pressure rapid execution of the archive.
Kaspersky classifies the detections as Trojan.JS.MirageKitten.* and attributes the activity to Mirage Kitten with high confidence, citing shared session‑handshake logic and proxy techniques with prior native tooling. The group's pivot to Node.js and JavaScript implants — with cross‑platform persistence and developer‑workflow hooks — represents a deliberate move to blend into developer machines and cloud‑centric traffic. For full IoCs and hashes, Kaspersky offers additional details through its Threat Intelligence Reporting service.
