Mirage Kitten APT Shifts to Cross-Platform Node.js Malware in Targeted LinkedIn Recruitment Campaign

Executive Summary\n\nRecent intelligence from Kaspersky and Security Affairs indicates that the Iranian-aligned threat actor Mirage Kitten (also tracked as UNC1549 and Nimbus Manticore) has significantly evolved its arsenal. The group is currently conducting a highly targeted espionage campaign against developers and IT professionals, primarily in the Middle East and Africa. By leveraging fraudulent LinkedIn recruitment profiles, the actors entice victims into downloading "coding assessments" that contain previously undocumented malware families: NodeRabbit and PollCat. This shift marks a departure from the group's traditional use of compiled binaries toward cross-platform scripting languages, enabling them to target Windows, macOS, and Linux environments with a single codebase.\n\n## Threat Analysis\n\nThe campaign's primary delivery mechanism is social engineering via LinkedIn. Threat actors pose as recruiters for legitimate-sounding technology firms and invite candidates to participate in a technical interview process. The "test" involves a ZIP archive containing a Node.js project. A critical component of this lure is a README file that explicitly prohibits the use of AI assistants during the test, citing "anti-cheating" measures Kaspersky. In reality, this instruction is designed to prevent the victim from using AI-powered code review tools, which would likely identify the malicious npm packages and suspicious first-line imports used to trigger the infection chain.\n\n## Technical Details\n\nThe malware families identified, NodeRabbit and PollCat, are sophisticated remote access trojans (RATs). NodeRabbit is written in Node.js, while PollCat is a JavaScript-based variant. Both are designed for cross-platform compatibility, allowing the actors to maintain a persistent presence across diverse operating systems OffSeq. Upon execution, the malware harvests comprehensive system information, including hardware specifications, user credentials, and directory structures. It establishes a connection to a command-and-control (C2) server to exfiltrate data and receive further instructions, such as deploying additional tunneling tools like ArcBridge and BridgeHead Kaspersky.\n\n## Attribution Assessment\n\nSecurity researchers at Kaspersky GReAT have attributed this activity to Mirage Kitten with high confidence. The group's TTPs, including the focus on Middle Eastern targets and the use of specific C2 infrastructure, align with historical patterns associated with Iranian state-sponsored espionage. The adoption of Node.js malware suggests a strategic investment in bypassing traditional endpoint detection and response (EDR) solutions that may be more attuned to monitoring compiled executables.\n\n## Implications\n\nThe targeting of developers is particularly concerning, as these individuals often possess elevated privileges and access to sensitive source code repositories. By compromising a developer's workstation, Mirage Kitten could potentially facilitate supply chain attacks or gain deep access to corporate networks. The use of "No AI" rules in social engineering highlights how threat actors are adapting to the widespread adoption of defensive AI tools.\n\n## Recommendations\n\nOrganizations should implement strict policies regarding the execution of external code for recruitment purposes. Security teams are advised to monitor for unusual Node.js activity, particularly involving outbound connections to unknown domains. Furthermore, developers should be encouraged to use sandboxed environments for any external technical assessments and to remain vigilant against unsolicited recruitment offers on professional social networks.