Loading story…
Iran-linked cyberespionage actor Mirage Kitten (also tracked as UNC1549) targeted software engineers at fintech, aviation, and aerospace organizations in the Middle East and Africa using fake recruiter personas and trojanized coding assessments distributed through LinkedIn and other employment platforms. Confirmed victims were identified in Afghanistan, Egypt, and Ethiopia. The malicious projects deployed two previously undocumented cross-platform Node.js/JavaScript remote-access trojans, NodeRabbit and PollCat, against Windows, Linux, and macOS systems.
The malware abuses trusted developer workflows and can expose source code, credentials, repositories, and corporate services. NodeRabbit includes anti-analysis features, enterprise-proxy support, Outlook discovery, expanded command-and-control capabilities, and persistence through malicious Visual Studio Code extensions and Git hooks; PollCat starts C2 communications before the victim completes the lure's purported OTP authentication and supports command execution, file and process operations, persistence, and reconnaissance. The operators used Azure-hosted and Cloudflare-backed infrastructure to make C2 traffic resemble legitimate cloud activity; organizations should independently validate recruiter identities, isolate coding tests, inspect dependencies and hidden project files, and monitor for anomalous Node.js, VS Code-extension, and Git-hook activity.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
PollCat supported shell and JavaScript execution, file transfer and manipulation, process control, system inventory, and security-product discovery. It persisted through Windows scheduled tasks, Linux cron entries, and macOS cron or LaunchAgent mechanisms.
Later NodeRabbit variants added analysis-environment checks, enterprise proxy support, expanded command-and-control capabilities, Outlook and development-project discovery, and C2 server replacement. A third variant established persistence through a malicious Visual Studio Code extension posing as GitHub Copilot Helper and launchers inserted into Git post-merge and post-checkout hooks.
The actors used the TaskFlow and RankChallenge-react lure projects to deploy the previously undocumented cross-platform Node.js/JavaScript remote-access trojans NodeRabbit and PollCat on Windows, Linux, and macOS. TaskFlow loaded NodeRabbit through a locally bundled malicious colorized_terminal package, while PollCat began command-and-control polling before completion of a fraudulent OTP authentication flow.
Iran-linked Mirage Kitten (UNC1549) used fake recruiter personas on LinkedIn and other employment platforms to send software engineers malicious coding challenges. The campaign targeted fintech, aviation, and aerospace organizations in the Middle East and Africa, with infected systems identified in Afghanistan, Egypt, and Ethiopia.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked **Mirage Kitten** targeted software engineers connected to fintech and aviation/aerospace organizations in Egypt, Ethiopia, and Afghanistan through fraudulent recruiter personas on LinkedIn and job platforms. The operators sent legitimate-looking Amazon S3-hosted coding assessments, including Node.js and React projects that concealed malicious npm packages; some lures told candidates not to use AI assistants, apparently to prevent automated review from exposing the malicious imports. Running the supplied projects deployed the newly documented cross-platform **NodeRabbit** and **PollCat** remote-access trojans. NodeRabbit uses encrypted Azure-hosted command-and-control, performs sandbox-evasion checks, supports reconnaissance, persistence, command execution and file transfer, and has used counterfeit VS Code extensions, Git hooks, and local Outlook email collection; PollCat contacts its command server as soon as its purported React challenge loads. Kaspersky attributed the activity to Mirage Kitten with high confidence based on shared command-and-control behavior and structural overlap with its Retrograde/MiniFast malware, while noting Azure Websites and Cloudflare-fronted domains in the campaign infrastructure.
Sep 2, 2026
Security researchers reported multiple malware campaigns emphasizing stealth and automation. K7 Lab analyzed a **Python-based RAT** packaged inside an apparently benign **ELF** executable, effectively embedding a Python runtime and scripts to evade simple file-type controls and complicate static inspection; the RAT also uses **adaptive beaconing** to reduce network noise by polling C2 rapidly when active (e.g., sub-second intervals) and sleeping longer when idle (e.g., `config.HELLO_INTERVAL`), lowering the chance of detection by behavior-based monitoring. Separately, threat reporting described a Vietnamese actor (“**Huna**”) targeting job seekers with phishing lures (often via **Dropbox-hosted** archives/links) to deliver **PureRAT** and related payloads, with tooling that shows strong indicators of **generative-AI-assisted development** (unusually detailed comments, numbered steps, and even operator instructions embedded in scripts). An Iran-aligned espionage operation attributed to **RedKitten** targeted Iranian human-rights NGOs and activists using malicious **Microsoft Excel** lures and multi-stage malware, including **AI-generated/obfuscated macros**, cloud and messaging platforms for C2 (e.g., *GitHub*, *Google Drive*, *Telegram*), and TTP overlap with known Iranian groups (e.g., *Charming Kitten*/*Nemesis Kitten* patterns), indicating continued evolution toward AI-enabled tradecraft and resilient infrastructure.
Jun 29, 2026
Reporting describes two separate **Iran-linked espionage** efforts. HarfangLab detailed a campaign dubbed **RedKitten** targeting human-rights NGOs and individuals documenting abuses, using a lure delivered as a Farsi-named `7z` archive containing macro-enabled Excel (`.xlsm`) files. When victims enable the malicious VBA, it drops a C# implant (`AppVStreamingUX_Multi_User.dll`) via **AppDomainManager injection**; the operation uses **GitHub** and **Google Drive** for configuration/payload retrieval and **Telegram** for command-and-control, and researchers noted code characteristics consistent with **LLM-assisted** development. Separately, Pulsedive research (as summarized) attributed a PowerShell backdoor called **TAMECAT** to **APT42**, describing social-engineering via impersonated WhatsApp contacts and links abusing the `search-ms` URI handler, followed by VBScript-based staging and delivery mechanisms including WebDAV-hosted LNKs disguised as PDFs. TAMECAT was reported to steal credentials from **Microsoft Edge** and **Chrome**, establish persistence (e.g., logon scripts and registry run keys), and use multiple C2 channels (including **Telegram**, Discord, Firebase, and Cloudflare Workers). Other items in the set cover unrelated events: a supply-chain compromise of *eScan* antivirus update infrastructure distributing a backdoor, and Fortinet’s reporting on **Interlock** ransomware activity affecting primarily UK/US organizations (not Iran-linked).
Jun 29, 2026