Threat reportMalwareTL-2026-4201
Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat RATs against aviation and FinTech via fake-recruiter coding challenges
Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat (TL-2026-4201), also tracked as NodeRabbit campaign, is a high-severity malware campaign, first published 2026-10-23. It is attributed to Mirage Kitten (Iran) with high confidence, affects Node.js / npm ecosystem npm packages colorized_terminal and pretty-log, maps to 22 MITRE ATT&CK techniques (T1027, T1036.005, T1053.003), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 2Mirage Kitten
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4201
- Threat ID
- TL-2026-4201
- Also known as
- NodeRabbit campaign, PollCat campaign, Fake-recruiter coding-challenge campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Mirage Kitten, UNC1549
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- aviation, aerospace, fintech, defense, software-development
- Target regions
- Middle East, Africa, egypt, ethiopia, afghanistan
- Detection rules
- 9
- Indicators of compromise
- 30
How Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat works
Kaspersky (Securelist, 2026-09-01) reports Mirage Kitten (aka UNC1549, Smoke Sandstorm, Nimbus Manticore) targeting aviation/aerospace and FinTech organizations in the Middle East and Africa, mainly Egypt, Ethiopia and Afghanistan, with two new cross-platform Node.js/JavaScript RATs, NodeRabbit and PollCat. Fake recruiters on job platforms deliver trojanized coding-challenge archives; NodeRabbit is launched via the trojanized npm packages colorized_terminal and pretty-log (v2.1.0).
Kaspersky identified two previously undocumented JavaScript/Node.js RATs, NodeRabbit and PollCat, attributed to the Iran-linked espionage actor Mirage Kitten (tracked elsewhere as UNC1549, Smoke Sandstorm and Nimbus Manticore). They are reported as the group's first publicly documented malware built on Node.js/JavaScript. Targets are software engineers and staff at aviation, aerospace and FinTech organizations in the Middle East and Africa. The first cases were found in Afghanistan, Egypt and Ethiopia. Archive submissions also came from India, Turkey, Israel, Iraq, Germany and Ireland.
Infection chain: a fake recruiter contacts the target on LinkedIn or another job platform and sends a coding-challenge archive. The archive is hosted on Amazon S3, which Securelist describes as a shift from the group's earlier onlyoffice.com delivery. The README steers the victim away from the malicious server.js. A three-hour time limit and a ban on AI assistants discourage code review. A bundled malicious npm package runs on import and launches the implant as a detached background process.
NodeRabbit is cross-platform (Windows, Linux, macOS) and has three reported variants. Variant 1 (Afghanistan) is launched through the trojanized colorized_terminal v2.1.0 package. It runs from node_modules/.cache/.320697f1/index.js, binds a TCP listener on 127.0.0.1:48739, uses AES-256-GCM-encrypted JSON to Azure-hosted C2, and has 11 commands. Variant 2 (Egypt) uses the trojanized pretty-log v2.1.0 package. It adds sandbox detection with benign HEAD requests before it terminates, corporate proxy support with NTLM/Negotiate authentication, a host-derived port (41984 + identifier mod 5000), and persistence under the name 'Intel Driver & Support Assistant'. Variant 3 (Ethiopia) uses /sdk/v2/ready, /sdk/v2/config and /sdk/v2/events endpoints and has 23 commands, including outlook:emails. It persists through a fake 'GitHub Copilot Helper' VS Code extension and Git hooks (post-merge, post-checkout) marked 'shepherd-persist', adds WSL-aware persistence and daily 10AM scheduled tasks, and chains C2 through visitfinancedentists.com, an azurewebsites.net host and healthcomfsdpower.com.
PollCat is delivered as the 'RankChallenge-react' challenge. It is an obfuscated JavaScript RAT that runs at application start-up. Registration treats an unusual HTTP 400 response containing a socketId as success. It declares 22 commands (3 unimplemented) in a little-endian binary, Base64-encoded format, including EVAL_JS, RUNDLL, ZIP and CHUNKED_DOWNLOAD. Default polling is 2 minutes with 5 seconds of jitter. It checks for 24 hard-coded security-vendor folder names. Persistence is a daily 09AM scheduled task under %APPDATA%\Microsoft\Network on Windows, ~/.node_packages with @reboot and daily cron on Linux, and a LaunchAgent on macOS.
Attribution to Mirage Kitten rests on structural overlap with the group's MiniFast/Retrograde backdoor (identical C2 handshake logic treating HTTP 400 as success, shared socketId session setup, 120s poll / 5s jitter / 60s retry defaults, overlapping command IDs, curl.exe-based proxy authentication), consistent geographic targeting, and Azure/Cloudflare infrastructure patterns. Kaspersky detects the malware as Trojan.JS.MirageKitten.*. Earlier public reporting (Mandiant/Google, Feb 2024) describes UNC1549 as active since at least June 2022, using Azure-hosted C2, job-themed lures and the MINIBIKE/MINIBUS backdoors against aerospace, aviation and defense. No CVE is involved.
MITRE ATT&CK techniques used in TL-2026-4201
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks
Persistence
T1053.003 Cron; T1053.005 Scheduled Task; T1176.002 IDE Extensions; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Collection
T1114.001 Local Email Collection; T1560.001 Archive via Utility
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1566.003 Spearphishing via Service
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1585.001 Social Media Accounts
Affected products and versions in Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat
- Node.js / npm ecosystem — npm packages colorized_terminal and pretty-log
Vulnerable versions: colorized_terminal 2.1.0; pretty-log 2.1.0 - Microsoft / Apple / Linux — Windows, macOS and Linux developer workstations running Node.js
Vulnerable versions: Hosts executing trojanized coding-challenge projects
Remediation for Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat
Immediate actions
- Block and alert on the listed azurewebsites.net, Cloudflare-fronted and S3 indicators at proxy/DNS
- Hunt for node_modules/.cache/.320697f1/index.js, msedge_update.js, and npm packages colorized_terminal or pretty-log v2.1.0
- Hunt for Git hooks (post-merge, post-checkout) containing 'shepherd-persist' and for the 'GitHub Copilot Helper' VS Code extension
- Isolate hosts where a coding-challenge archive was run and rotate credentials and tokens available to the developer account
Workarounds
- Allow-list VS Code extensions and monitor extension installs
- Monitor and restrict outbound traffic to newly registered domains and unsanctioned *.azurewebsites.net hosts
Longer-term hardening
- Prohibit running third-party coding assessments on corporate endpoints; use disposable sandboxed VMs
- Restrict npm installs to vetted registries or mirrors with package allow-listing and install-script controls
- Alert on node.exe spawning detached children, listening on loopback ports, or creating persistence outside developer tooling
- Brief engineers and HR/recruiting-facing staff on fake-recruiter social engineering
Timeline of Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat
- UNC1549 activity observed since at least June 2022 per Mandiant/Google reporting (day approximate).
- Earliest registration among the reported domains (mens-health-online.com), per Securelist.
- A further batch of campaign domains registered on 2026-07-03.
- Cloud Security Alliance research note documents Nimbus Manticore's NightLedger backdoor and relay network.
- Kaspersky detection names Trojan.JS.MirageKitten.* published alongside the report.
- Kaspersky publishes Securelist report disclosing NodeRabbit and PollCat and attributing them to Mirage Kitten.
- GBHackers coverage of the campaign dated 2026-09-21.
Sources cited for Mirage Kitten (UNC1549) deploys new NodeRabbit and PollCat
- Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set
- SOC Prime: Mirage Kitten Deploys NodeRabbit and PollCat Through Job Offer Lures
- GBHackers: Mirage Kitten campaign
- The Hacker News: Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defense Sectors
- SecurityWeek: Iranian Hackers Target Aviation and Defense Sectors in Middle East
- CSA Research Note: Nimbus Manticore's NightLedger Backdoor and Covert Relay Network
Detection coverage for TL-2026-4201
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4201 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.