Phishing detection has taken on a new dimension as Mirage Kitten has been linked to a campaign that disguises malware as legitimate software-development assessments. According to research published by Kaspersky on September 1, 2026, the activity uses fake recruiter personas, trojanized coding challenges, and two previously undocumented cross-platform remote access trojans (RATs), NodeRabbit and PollCat.

The campaign is particularly relevant to organizations employing software engineers, because the attack abuses a workflow developers are accustomed to: receiving a project, installing dependencies, reviewing source code, and running an application. Kaspersky says the activity targeted aviation, aerospace, and FinTech organizations across the Middle East and Africa. The research does not mean every developer receiving a coding assessment is at risk, but it demonstrates why software projects obtained through unsolicited recruitment contacts should be treated as untrusted code.

What Happened in the Mirage Kitten Campaign?

Kaspersky researchers identified NodeRabbit after finding a suspicious software-development project on a system in Afghanistan. Further threat hunting uncovered additional NodeRabbit variants associated with systems in Egypt and Ethiopia. A separate malware family, PollCat, was found in another coding challenge.

The initial access technique relied on fake recruiter accounts contacting software engineers through LinkedIn and other job-search platforms. Targets were presented with technical assessments and encouraged to download and execute project archives. This is consistent with MITRE ATT&CK’s T1566.003, Spearphishing via Service, which describes targeted phishing through third-party platforms such as social media and professional networking services.

The important distinction is that this was not simply a malicious link disguised as a job offer. The lure was a functioning development project that appeared to require ordinary engineering work.

One documented archive, Front-Technical-Challenge.zip, contained a TaskFlow application built using Express, React, and Vite. Its instructions directed the candidate toward frontend problems while indicating that a particular server-side file should not be modified. That file contained the malicious dependency mechanism.

How Fake Coding Challenges Deliver NodeRabbit and PollCat

The campaign demonstrates how social engineering and software supply-chain techniques can overlap.

In the NodeRabbit chain, researchers found a trojanized colorized_terminal package, version 2.1.0, bundled directly inside the project’s local node_modules directory. Unlike an ordinary dependency installation, the malicious component was already present in the supplied archive. When imported by the application, it launched the concealed NodeRabbit payload. Kaspersky also identified another trojanized package, pretty-log, in related samples.

The lure was reinforced psychologically. The README imposed a time limit and instructed candidates not to use AI assistants. These restrictions created pressure to complete the assessment quickly while discouraging additional code-review assistance. Kaspersky observed that inspection of the suspicious dependency could have revealed the tampering.

PollCat followed a similar concept through a separate React-based challenge called RankChallenge-react. The project presented itself as a programming assessment with a time-limited, one-time-code workflow. Researchers found that the malicious component could operate in the background rather than relying solely on successful completion of the visible authentication process.

For defenders, this matters because the initial malicious action may occur inside a legitimate-looking development workflow rather than through a conventional executable attachment.

What Are NodeRabbit and PollCat?

NodeRabbit is a Node.js-based RAT designed to operate across Windows, Linux, and macOS. Kaspersky identified multiple variants and found operating-system-specific persistence mechanisms. These included Registry-based startup mechanisms on Windows, cron-based persistence on Linux, and LaunchAgents on macOS.

The malware can collect host information and communicate with command-and-control infrastructure. Later variants incorporated additional developer-focused persistence techniques, including a fraudulent Visual Studio Code extension and malicious Git hooks. These mechanisms are especially notable because they attempt to remain embedded within workflows developers routinely use.

PollCat is a separate cross-platform RAT written in obfuscated JavaScript. Kaspersky found functionality for system inventory, process discovery, file operations, command execution, and other remote-control activity. Its design also showed similarities with earlier Mirage Kitten tooling, supporting the researchers’ attribution.

Kaspersky says NodeRabbit and PollCat represent the first publicly documented use of Node.js- and JavaScript-based malware by Mirage Kitten, which had historically relied more heavily on native malware written in languages such as C, C++, and Go.

Why This Campaign Matters for Phishing Detection

Traditional phishing detection often focuses on email messages, malicious URLs, fake login pages, and suspicious attachments. This campaign illustrates why detection must also account for social platforms, developer ecosystems, cloud-hosted files, and software projects.

MITRE ATT&CK specifically identifies fake job opportunities and messages sent through social platforms as examples of spearphishing via service. Detection guidance recommends correlating activity from third-party messaging services with unexpected downloads, file creation, and suspicious process execution.

For a security operations team, relevant signals include:

• Unexpected development projects downloaded from external contacts.
• js processes launched from unusual project or cache directories.
• New persistence mechanisms appearing after a developer executes an unfamiliar project.
• Unexpected changes involving Git hooks or IDE extension directories.
• Outbound connections from development workstations to previously unseen infrastructure.
• Coding assessments containing bundled dependencies that do not match expected project requirements.
• Recruitment communications that impose unusual urgency or discourage independent review.

These indicators should be correlated rather than treated individually as proof of compromise.

Why Legitimate Cloud Infrastructure Creates Additional Risk

The campaign also demonstrates the limitations of infrastructure-based blocking alone.

Kaspersky identified Azure Websites and Cloudflare-backed infrastructure associated with the malware, while one documented coding challenge was hosted through Amazon S3. Legitimate cloud services can therefore appear in an attack chain without the underlying provider itself being malicious.

This is where contextual threat intelligence becomes valuable. A domain or cloud endpoint should not be classified as malicious simply because it uses a major provider. Analysts should consider the domain, content, registration history, DNS behavior, certificate activity, malware associations, communications, and observed behavior together.

A modern threat intelligence tool can help security teams correlate these signals, while a domain monitoring service can provide additional visibility into newly registered or newly activated domains associated with an organization’s brand.

For brand protection teams, the distinction is equally important. A suspicious domain is not automatically evidence that an organization has been compromised. Domain similarity, suspicious infrastructure, malicious behavior, and confirmed organizational compromise are separate findings.

What Security Teams Should Investigate

Organizations with developer-heavy environments should treat externally supplied coding projects as potentially untrusted software, particularly when the source is an unsolicited recruiter or an unfamiliar third-party account.

A practical investigation should include:

1. Validate the recruitment interaction. Determine whether the recruiter and advertised position can be independently verified through trusted organizational channels.
2. Review the project before execution. Inspect dependency manifests, bundled node_modules content, startup scripts, and unexpected JavaScript files.
3. Correlate endpoint activity. Look for unusual Node.js processes, unexpected child processes, new persistence mechanisms, and network connections following project execution.
4. Review developer tooling. Check for unexpected VS Code extensions, Git hook modifications, and other changes affecting development workflows.
5. Hunt across affected endpoints. Search for related file hashes, domains, infrastructure indicators, and behavioral patterns rather than relying only on a single malware signature.
6. Preserve evidence. Retain the original message, archive metadata, project files, endpoint telemetry, and relevant network records for incident-response analysis.
7. Monitor related infrastructure. Where public indicators are available, track associated domains and infrastructure for additional activity.

This approach supports both endpoint investigation and broader attack surface security, particularly when developer workstations have access to source repositories, cloud environments, credentials, signing systems, or production infrastructure.

How Domain Intelligence Supports the Wider Investigation

The Mirage Kitten campaign is primarily an endpoint and social-engineering story, but its infrastructure provides an important lesson for external monitoring.

Kaspersky published domains and other indicators associated with NodeRabbit and PollCat, including Azure-hosted endpoints and other infrastructure. Security teams can use these indicators within SIEM, EDR, DNS, firewall, and threat-intelligence workflows.

For organizations concerned about brand abuse, external monitoring adds another layer. SpoofGuard’s current platform describes capabilities for discovering lookalike domains, monitoring domain activity, analyzing website content, tracking DNS and SSL-related signals, and supporting phishing investigations.

Its phishing detection and brand protection use cases can be relevant when threat actors create domains or websites that imitate an organization’s identity as part of a broader campaign. This does not replace EDR, email security, MFA, SIEM, or incident response. Instead, domain intelligence can complement those controls by providing visibility outside the corporate network.

SpoofGuard has also published research on fake npm malware and developer-targeting campaigns, providing additional context on why development ecosystems deserve attention from security teams.

Security Checklist for Developer Recruitment Attacks

Security and IT teams should consider the following controls:

• Treat unsolicited coding assessments as untrusted software.
• Verify recruiters and job opportunities independently.
• Avoid executing unfamiliar projects directly on production or privileged workstations.
• Review dependencies before running development projects.
• Monitor Node.js execution and unexpected child processes.
• Alert on new persistence mechanisms created by development applications.
• Monitor Git hooks and IDE extension changes.
• Correlate endpoint events with network and DNS telemetry.
• Add confirmed campaign indicators to appropriate detection systems.
• Monitor external domains and infrastructure associated with brand impersonation.
• Preserve evidence before deleting suspicious project files.
• Coordinate endpoint, threat-intelligence, and brand-protection investigations.

For MSSPs, the campaign also illustrates why client monitoring should extend beyond conventional network telemetry. A managed program can correlate developer-targeting campaigns, suspicious infrastructure, domain abuse, and client-specific brand indicators across multiple organizations.

Frequently Asked Questions

What is NodeRabbit?

NodeRabbit is a previously undocumented cross-platform remote access trojan identified by Kaspersky in September 2026. It is built with Node.js and has been observed in trojanized coding challenges delivered through fake recruitment approaches. Kaspersky identified variants affecting Windows, Linux, and macOS environments.

What is PollCat malware?

PollCat is a separate JavaScript-based cross-platform RAT identified by Kaspersky during the same investigation. It was delivered through a fraudulent React coding challenge and included capabilities for system discovery, file operations, command execution, and communication with attacker-controlled infrastructure.

Does a suspicious domain prove that an organization was compromised?

No. A suspicious or lookalike domain can indicate potential impersonation or phishing infrastructure, but domain similarity alone does not establish that the legitimate organization was breached. Analysts should distinguish domain similarity, observed malicious behavior, phishing activity, and confirmed organizational compromise.

How can companies improve phishing detection against fake job lures?

Phishing detection should cover more than email. Organizations should monitor third-party messaging services, correlate recruitment-related downloads with endpoint activity, inspect externally supplied software, and hunt for suspicious execution and persistence. MITRE ATT&CK recommends correlating third-party service activity with file creation, process execution, and network connections for spearphishing-via-service scenarios.

Strengthen Visibility Across Your External Threat Surface

The Mirage Kitten campaign shows how attackers can turn an ordinary hiring workflow into an initial-access opportunity. Defending against this type of activity requires layered controls spanning security awareness, endpoint detection, software supply-chain review, threat intelligence, and external domain visibility. Organizations can evaluate SpoofGuard’s seven-day free trial to explore continuous domain monitoring and brand-protection capabilities as one component of a broader security strategy.

Disclaimer: Spoofguard reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.