Mirage Kitten Hackers Use Fake Coding Challenges to Deploy NodeRabbit and PollCat RATs

Kaspersky documents an Iran-linked Mirage Kitten campaign that targets software developers with fake recruitment coding challenges containing trojanized Node.js projects; these deliver two cross‑platform RATs — NodeRabbit and PollCat — which provide persistence, host enumeration, remote command execution, file transfer, and Azure-hosted C2 communications. The attackers abuse developer workflows (npm packages, VS Code extensions, Git hooks), have observed victims in fintech, aviation, and aerospace across the Middle East and Africa, and published multiple domains/IOCs; defenders are advised to treat unsolicited assessments as untrusted, inspect dependencies, isolate execution, and monitor for unexpected Node.js processes and new persistence mechanisms.