Executive Summary
Mirage Kitten (also known as UNC1549 or Smoke Sandstorm) has transitioned to cross-platform tooling with the introduction of NodeRabbit and PollCat, two previously undocumented remote access trojans (RATs). The group specifically targets software engineers in the aviation and FinTech sectors across the Middle East and Africa, utilizing social engineering on LinkedIn to deliver trojanized coding challenge archives hosted on Amazon S3.
Technically, the campaign marks a significant shift from native binaries to Node.js and JavaScript-based malware, allowing for seamless operation across Windows, Linux, and macOS environments. The malware utilizes sophisticated persistence mechanisms, including Git hook injection and malicious VS Code extensions, while leveraging Azure Websites and Cloudflare for command-and-control (C2) infrastructure to blend into legitimate corporate traffic.
The business impact of this activity is high for targeted sectors, as the RATs provide full filesystem access, credential harvesting, and the ability to execute arbitrary scripts. The use of legitimate developer workflows for persistence makes detection challenging for traditional endpoint security solutions that may not monitor Node.js child processes or Git configuration changes.