Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Mirage Kitten deployed two previously undocumented cross-platform RAT families—NodeRabbit (Node.js) and PollCat (obfuscated JavaScript)—via trojanized coding-challenge archives distributed through fake recruiter outreach on job platforms; both target Windows, Linux and macOS, include multiple persistence and reconnaissance capabilities (including VS Code extension and Git-hook persistence), use Azure/Cloudflare-backed C2 infrastructure, and were observed on systems in Afghanistan, Egypt and Ethiopia with extensive IoCs and file hashes provided.