Mirage Kitten Hackers Use Fake Coding Challenges to Deploy NodeRabbit and PollCat RATs

Gbhackers •Mayura Kathir • September 1, 2026

Iran-linked threat actor Mirage Kitten is targeting software developers with fake recruitment assessments that hide two newly identified cross-platform remote access trojans: NodeRabbit and PollCat. The campaign uses recruiter impersonation on and other job- platforms, weaponized Node.js projects, and cloud-hosted ZIP archives to gain covert access to developer endpoints across Windows, Linux, and macOS. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mirage Kitten Targets Aviation and FinTech with New Cross-Platform Malware The Iranian cyberespionage group Mirage Kitten has launched a campaign targeting technology professionals in the aviation and FinTech sectors across the Middle East and Africa. This operation involves the use of two newly discovered malware families, NodeRabbit and PollCat, both of which are cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. The first instance of NodeRabbit was detected on a system in Afghanistan, with subsequent detections in Egypt and Ethiopia. Attackers deliver these malware strains through spear-phishing emails disguised as job offers, containing trojanized coding challenge archives. The malicious archives instruct candidates to complete coding tasks while explicitly prohibiting the use of AI tools, likely to evade detection. Kaspersky has identified that these malware families represent a shift from Mirage Kitten's previous reliance on malware written in C, C++, and Go. The campaign is ongoing, and organizations in the targeted sectors are advised to remain vigilant. 8 sources 79

Extracted Entities

Mirage Kitten Hackers Use Fake Coding Challenges to Deploy NodeRabbit and PollCat RATs

The full story

Extracted Entities

Attack Types (2)

Countries (1)

Malware (2)

MITRE ATT&CK (1)

Platforms (3)