Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Mirage Kitten, an APT group, is conducting cyberespionage campaigns targeting the aviation and FinTech sectors in the Middle East and Africa. The group uses spear-phishing via fake recruiter accounts on LinkedIn to deliver trojanized coding challenge archives, leading to the deployment of two newly identified cross-platform malware families: NodeRabbit and PollCat. NodeRabbit is a Node.js-based remote access trojan (RAT) with three variants, each exhibiting increasing sophistication in persistence and evasion techniques. PollCat is a JavaScript-based RAT distributed through a separate coding challenge, using similar infrastructure and TTPs. Both malware families communicate with C2 servers hosted on Azure and Cloudflare domains, leveraging legitimate cloud services to blend in with normal traffic.

AI-extracted · verify before operational use