Mirage Kitten Deploys NodeRabbit and PollCat Through Trojani...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244
• Blog Title: Mirage Kitten Deploys NodeRabbit and PollCat Through Trojanized Coding Challenges
• Suggested Section: Generic Methodologies & Resources > Phishing Methodology > Trojanized Coding Challenges and Developer Recruitment Attacks, with cross-references to Pentesting Web > NodeJS Express/npm supply-chain abuse and Windows/Linux/macOS persistence sections

🎯 Content Summary

Overview and impact

Mirage Kitten deployed two previously undocumented cross-platform remote-access trojans, NodeRabbit and PollCat, against developer workstations. Confirmed NodeRabbit infections were found in Afghanistan, Egypt, and Ethiopia, affecting organizations in the fintech, aviation, and aerospace sectors across the Middle East and Africa. Related trojanized archives were also submitted to an online multi-scanner from India, Türkiye, Israel,...

🔧 Technical Details

Trojanized local npm dependency: An attacker can bundle a malicious package directly inside a project's node_modules directory and import it from an early startup file such as server.js. The package does not need to exist in the public npm registry. Module initialization can launch a concealed JavaScript implant as a detached process, meaning that simply starting the supplied application triggers compromise. Review startup imports, local dependencies, package lifecycle scripts, unexpected package versions, and hidden paths such as node_modules/.cache.

Pre-authentication module side effects: A malicious application can display OTP, JWT, or login controls while starting malware during module import, before authentication middleware processes any request. Failed authentication then protects only the decoy interface. A successful login may trigger persistence or create additional workers. Audits must trace im...

🤖 Agent Actions

Updated:

src/generic-methodologies-and-resources/phishing-methodology/README.md

Added technical coverage for:

• Trojanized coding challenges and bundled local npm dependencies
• Import-time execution before authentication
• Dependency/bootstrap auditing commands
• VS Code extension and Git-hook persistence
• Cross-platform autostarts and WSL bridging
• Proxy-aware C2, HTTP 400 handshakes, and TCP mutex detection
• Cross-references to existing Node.js, Git, Windows, Linux, and macOS pages
• Numbered citation to the Securelist research

Validation passed for Markdown structure, citations, internal links, forbidden sources, and git diff --check. mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://securelist.com/mirage-kitten-new-backdoors-noderabbit-pollcat/121244

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Phishing Methodology > Trojanized Coding Challenges and Developer Recruitment Attacks, with cross-references to Pentesting Web > NodeJS Express/npm supply-chain abuse and Windows/Linux/macOS persistence sections".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0