Loading story…
Iran-linked Mirage Kitten targeted software engineers connected to fintech and aviation/aerospace organizations in Egypt, Ethiopia, and Afghanistan through fraudulent recruiter personas on LinkedIn and job platforms. The operators sent legitimate-looking Amazon S3-hosted coding assessments, including Node.js and React projects that concealed malicious npm packages; some lures told candidates not to use AI assistants, apparently to prevent automated review from exposing the malicious imports.
Running the supplied projects deployed the newly documented cross-platform NodeRabbit and PollCat remote-access trojans. NodeRabbit uses encrypted Azure-hosted command-and-control, performs sandbox-evasion checks, supports reconnaissance, persistence, command execution and file transfer, and has used counterfeit VS Code extensions, Git hooks, and local Outlook email collection; PollCat contacts its command server as soon as its purported React challenge loads. Kaspersky attributed the activity to Mirage Kitten with high confidence based on shared command-and-control behavior and structural overlap with its Retrograde/MiniFast malware, while noting Azure Websites and Cloudflare-fronted domains in the campaign infrastructure.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky GReAT published research describing Mirage Kitten's use of fake recruiter personas and trojanized coding challenges to deliver the newly documented NodeRabbit and PollCat cross-platform RATs. The campaign targeted fintech and aviation/aerospace organizations in Egypt, Ethiopia, and Afghanistan, and Kaspersky attributed the activity to Mirage Kitten based on technical overlaps with Retrograde/MiniFast.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked cyberespionage actor **Mirage Kitten** (also tracked as `UNC1549`) targeted software engineers at fintech, aviation, and aerospace organizations in the Middle East and Africa using fake recruiter personas and trojanized coding assessments distributed through LinkedIn and other employment platforms. Confirmed victims were identified in Afghanistan, Egypt, and Ethiopia. The malicious projects deployed two previously undocumented cross-platform Node.js/JavaScript remote-access trojans, **NodeRabbit** and **PollCat**, against Windows, Linux, and macOS systems. The malware abuses trusted developer workflows and can expose source code, credentials, repositories, and corporate services. NodeRabbit includes anti-analysis features, enterprise-proxy support, Outlook discovery, expanded command-and-control capabilities, and persistence through malicious Visual Studio Code extensions and Git hooks; PollCat starts C2 communications before the victim completes the lure's purported OTP authentication and supports command execution, file and process operations, persistence, and reconnaissance. The operators used Azure-hosted and Cloudflare-backed infrastructure to make C2 traffic resemble legitimate cloud activity; organizations should independently validate recruiter identities, isolate coding tests, inspect dependencies and hidden project files, and monitor for anomalous Node.js, VS Code-extension, and Git-hook activity.
Sep 9, 2026
Security researchers reported multiple malware campaigns emphasizing stealth and automation. K7 Lab analyzed a **Python-based RAT** packaged inside an apparently benign **ELF** executable, effectively embedding a Python runtime and scripts to evade simple file-type controls and complicate static inspection; the RAT also uses **adaptive beaconing** to reduce network noise by polling C2 rapidly when active (e.g., sub-second intervals) and sleeping longer when idle (e.g., `config.HELLO_INTERVAL`), lowering the chance of detection by behavior-based monitoring. Separately, threat reporting described a Vietnamese actor (“**Huna**”) targeting job seekers with phishing lures (often via **Dropbox-hosted** archives/links) to deliver **PureRAT** and related payloads, with tooling that shows strong indicators of **generative-AI-assisted development** (unusually detailed comments, numbered steps, and even operator instructions embedded in scripts). An Iran-aligned espionage operation attributed to **RedKitten** targeted Iranian human-rights NGOs and activists using malicious **Microsoft Excel** lures and multi-stage malware, including **AI-generated/obfuscated macros**, cloud and messaging platforms for C2 (e.g., *GitHub*, *Google Drive*, *Telegram*), and TTP overlap with known Iranian groups (e.g., *Charming Kitten*/*Nemesis Kitten* patterns), indicating continued evolution toward AI-enabled tradecraft and resilient infrastructure.
Jun 29, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026