Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Mirage Kitten is leveraging spear-phishing campaigns disguised as legitimate coding challenges to deliver two previously unknown cross-platform remote access trojans, NodeRabbit and PollCat, targeting aviation and FinTech organizations across the Middle East and Africa. The use of trojanized archives exploits the trust professionals place in routine recruitment or skills-assessment workflows, making detection more difficult and social engineering more effective. The shift to Node.js and JavaScript-based malware broadens the attack surface to multiple operating systems, bypassing defenses tuned for traditional native malware signatures. This campaign highlights how advanced threat actors continuously evolve their tooling and delivery mechanisms to outpace organizational defenses and threat intelligence.