--- title: Mirage Kitten switches to Node.js and JavaScript malware description: Kaspersky researchers uncovered new activity from the Mirage Kitten APT group involving two previously undocumented cross-platform RATs: NodeRabbit (Node.js)... canonical: https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Mirage Kitten switches to Node.js and JavaScript malware | daily.dev og:description: Kaspersky researchers uncovered new activity from the Mirage Kitten APT group involving two previously undocumented cross-platform RATs: NodeRabbit (Node.js)... og:url: https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm og:image: https://api.daily.dev/og/posts/ZfQWLqMsm.png og:image:alt: Mirage Kitten switches to Node.js and JavaScript malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Mirage Kitten switches to Node.js and JavaScript malware **[Securelist](https://daily.dev/sources/securelist)** · 21 min read · 2 upvotes · 0 comments ## Summary Kaspersky researchers uncovered new activity from the Mirage Kitten APT group involving two previously undocumented cross-platform RATs: NodeRabbit (Node.js) and PollCat (obfuscated JavaScript). Both are delivered via spear-phishing recruiter personas on LinkedIn and job platforms that trick software engineers into downloading trojanized coding-challenge archives hosted on Amazon S3. The malware bundles trojanized npm packages (colorized_terminal, pretty-log) directly in node_modules to avoid registry detection, implements OS-specific persistence (registry keys, cron, LaunchAgents, fake VS Code extensions, Git hook injection), and communicates over Azure- and Cloudflare-backed C2 infrastructure using AES-256-GCM encrypted JSON. PollCat additionally uses a fake OTP-gated CTF-style React app to pressure victims while running independently of authentication. Victims were found in fintech and aviation sectors across Egypt, Ethiopia, and Afghanistan, with attribution to Mirage Kitten based on code similarities to the Retrograde/MiniFast backdoor and consistent targeting patterns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the NodeRabbit malware get delivered to software engineers through fake job interviews? NodeRabbit is delivered through spear-phishing messages on LinkedIn and job search platforms where fake recruiters send trojanized coding challenge archives, such as a zip file hosted on Amazon S3 named Front-Technical-Challenge.zip. The archive contains a legitimate-looking Express/React/Vite project whose server.js imports a trojanized npm package bundled directly in node_modules, which silently launches the RAT as a background process. _Developers vetting job-related code samples can follow ongoing APT tradecraft coverage on daily.dev._ ### How can a trojanized npm package hide malware without publishing to the npm registry? Attackers can bundle a malicious npm package, such as colorized_terminal version 2.1.0, directly inside a project's node_modules directory rather than publishing it publicly, so it never appears in registry security scans. When the package is imported as the first line of a file like server.js, it silently launches a hidden implant as a detached background process from a cache subfolder. _Teams auditing dependency trust boundaries can track supply-chain attack patterns like this on daily.dev._ ### What persistence technique does malware use by injecting into Git hooks and fake VS Code extensions? One NodeRabbit variant installs a fake VS Code extension disguised as GitHub Copilot Helper that relaunches the payload on startup, while a separate technique scans developer directories for Git repositories and appends a marked launcher line to .git/hooks/post-merge and post-checkout so the malware restarts whenever those hooks fire during normal Git operations. _Developers hardening dev-environment security can follow emerging persistence tricks like this on daily.dev._ ## Similar posts on daily.dev - [Mirage Kitten’s new malware set: NightLedger backdoor and two tunneling tools](https://daily.dev/posts/mirage-kitten-s-new-malware-set-nightledger-backdoor-and-two-tunneling-tools-buarzlxck) · Securelist · 0 upvotes · 0 comments - [North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets](https://daily.dev/posts/north-korea-linked-npm-packages-impersonate-rollup-polyfill-tools-to-steal-developer-secrets-mvjcouuhx) · The Next Web · 2 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#nodejs](https://daily.dev/tags/nodejs), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Mirage Kitten switches to Node.js and JavaScript malware","url":"https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm"},"datePublished":"2026-09-01T07:03:55.979Z","dateModified":"2026-09-01T07:11:22.610Z","description":"Kaspersky researchers uncovered new activity from the Mirage Kitten APT group involving two previously undocumented cross-platform RATs: NodeRabbit (Node.js)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05e4b13d887721a76854ae81c8ba8993?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/05e4b13d887721a76854ae81c8ba8993?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,nodejs,malware,phishing","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"Mirage Kitten switches to Node.js and JavaScript malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/mirage-kitten-switches-to-node-js-and-javascript-malware-zfqwlqmsm#faq","mainEntity":[{"@type":"Question","name":"How does the NodeRabbit malware get delivered to software engineers through fake job interviews?","acceptedAnswer":{"@type":"Answer","text":"NodeRabbit is delivered through spear-phishing messages on LinkedIn and job search platforms where fake recruiters send trojanized coding challenge archives, such as a zip file hosted on Amazon S3 named Front-Technical-Challenge.zip. The archive contains a legitimate-looking Express/React/Vite project whose server.js imports a trojanized npm package bundled directly in node_modules, which silently launches the RAT as a background process. Developers vetting job-related code samples can follow ongoing APT tradecraft coverage on daily.dev."}},{"@type":"Question","name":"How can a trojanized npm package hide malware without publishing to the npm registry?","acceptedAnswer":{"@type":"Answer","text":"Attackers can bundle a malicious npm package, such as colorized_terminal version 2.1.0, directly inside a project's node_modules directory rather than publishing it publicly, so it never appears in registry security scans. When the package is imported as the first line of a file like server.js, it silently launches a hidden implant as a detached background process from a cache subfolder. Teams auditing dependency trust boundaries can track supply-chain attack patterns like this on daily.dev."}},{"@type":"Question","name":"What persistence technique does malware use by injecting into Git hooks and fake VS Code extensions?","acceptedAnswer":{"@type":"Answer","text":"One NodeRabbit variant installs a fake VS Code extension disguised as GitHub Copilot Helper that relaunches the payload on startup, while a separate technique scans developer directories for Git repositories and appends a marked launcher line to .git/hooks/post-merge and post-checkout so the malware restarts whenever those hooks fire during normal Git operations. Developers hardening dev-environment security can follow emerging persistence tricks like this on daily.dev."}}]} ```