Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Mirage Kitten has introduced two previously undocumented RATs, NodeRabbit and PollCat, marking a shift from native malware to cross-platform scripting-based implants. NodeRabbit is Node.js-based, while PollCat is JavaScript-based, both supporting Windows, Linux, and macOS environments. Infection vectors involve sophisticated social engineering campaigns using fake LinkedIn recruiters who lure victims with trojanized coding challenges hosted on Amazon S3 buckets. The malware implants backdoored npm packages that silently install persistent implants. NodeRabbit supports comprehensive C2 functions such as file operations, process management, and proxy-aware communications leveraging Azure and Cloudflare infrastructure. PollCat offers similar RAT capabilities with specialized persistence targeting Visual Studio Code extensions and Git hooks. The campaigns focus on the aviation and FinTech sectors across the Middle East and Africa. There is no indication of known exploits in the wild beyond these targeted attacks, and no patches apply as this is malware rather than a software vulnerability.

The deployment of NodeRabbit and PollCat RATs enables the threat actor to gain persistent remote access to compromised systems across multiple operating systems. This access allows file manipulation, process control, and covert communications through cloud infrastructure, potentially leading to espionage, data theft, or disruption within targeted aviation and FinTech organizations. The use of developer tool persistence mechanisms increases stealth and difficulty of detection. The impact is medium severity given the targeted sectors and capabilities but no evidence of widespread exploitation or destructive payloads has been reported.

No patches or official fixes exist as this is malware deployment by a threat actor rather than a software vulnerability. Organizations in the targeted sectors should be aware of social engineering tactics involving fake recruiters and trojanized coding challenges distributed via LinkedIn and Amazon S3. Defensive measures should focus on user awareness training to recognize social engineering, monitoring for suspicious npm package installations, and scrutinizing developer tool extensions and Git hooks for unauthorized modifications. Network monitoring for unusual Azure or Cloudflare C2 traffic may assist detection. Vendor advisories do not indicate any 'no action required' status; mitigation relies on detection and prevention of infection vectors.