Kaspersky GReAT has identified a targeted campaign by Mirage Kitten which uses fake LinkedIn recruitment communication and new cross-platform Node.js and JavaScript spyware targeting aviation and fintech sectors across the Middle East and Africa – specifically Egypt, Ethiopia and Afghanistan. Malware linked to these new attacks has also been detected across several other countries, including Germany, Türkiye, Israel, India, and Ireland. This follows Kaspersky’s recent discovery of Mirage Kitten’s new Windows backdoor reported in July.
The bait: Fake tech recruiters on LinkedIn
The attack chain begins with social engineering. Attackers pose as talent acquisition specialists at major tech companies on LinkedIn and reach out to software engineers working in aviation and financial technology. Candidates are invited to take a technical assessment and are sent a link to download a "coding challenge" hosted on legitimate Amazon cloud storage. To put pressure on the candidate, the attackers impose a strict time limit of one to three hours and warn against using AI code assistants (these would likely flag the malicious code hidden inside the package).
Once the developer downloads and runs the programming challenge on their workstation, the infiltration begins. As the victim developer is focused working on the software mockups, the malware secretly installs itself in the background.
The shift to new tactics
Mirage Kitten previously relied on native programs written in C, C++, or Go, targeting pure Windows environments. By rewriting their arsenal in Node.js and JavaScript, the group has now developed a single codebase that can attack Windows, macOS, and Linux seamlessly.
Kaspersky has identified two new malware families in this campaign, and each of these families is deployed depending on the particular victim. The first one is NodeRabbit, a Node.js Remote Access Trojan hidden inside common development packages. It gives attackers deep control of the infected machine. To maintain its access, the malware uses sophisticated, developer-focused persistence methods such as installing fake workspace extensions running alongside Microsoft Visual Studio Code or modifying the developer’s local code repositories to automatically launch the threat whenever they save or merge their project code. The second piece of malware is also a Remote Access Trojan, this time on JavaScript, called PollCat. It waits for candidates to submit a "one-time password" (supplied by “the recruiter”) to access the challenge, and then harvests system information, sweeping directories, and sending data to the attackers.
“The transition from traditional, compiled malware to JavaScript-based threats is a pivot in Mirage Kitten's tactics. By hijacking the recruitment process and injecting code directly into everyday developer tools, the group can evasively get past enterprise security boundaries. Developers typically hold elevated access privileges within corporate networks, making them an incredibly high-value target for advanced cyber-espionage,” comments Omar Amin, security expert at Kaspersky GReAT.
Read the full report on Securelist.
To stay protected from Mirage Kitten and other APTs, organizations are advised to follow these best practices:
- To protect the company against a wide range of threats, use solutions from the Kaspersky Next product line that provide real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR for organizations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.
- Adopt managed security services by Kaspersky such as Compromise Assessment, Managed Detection and Response (MDR) and / or Incident Response, covering the entire incident management cycle – from threat identification to continuous protection and remediation. They help to protect against evasive cyberattacks, investigate incidents and provide additional expertise even if a company lacks cybersecurity workers.
- Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. Kaspersky Threat Intelligence will provide them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.
About the Global Research & Analysis Team
Established in 2008, Global Research & Analysis Team (GReAT) operates at the very heart of Kaspersky, uncovering APTs, cyber-espionage campaigns, major malware, ransomware and underground cyber-criminal trends across the world. Today GReAT consists of 35+ experts working globally – in Europe, Russia, Latin America, Asia and the Middle East. Talented security professionals provide company leadership in anti-malware research and innovation, bringing unrivaled expertise, passion and curiosity to the discovery and analysis of cyberthreats.
