Mirage Kitten deploys NodeRabbit and PollCat via Azure-hosted coding tests in Africa and Middle East

The campaign relied on Amazon S3 and Microsoft Azure infrastructure, including subdomains that incorporated victim organization names to blend C2 traffic with legitimate corporate flows. NodeRabbit executes on Windows, Linux, and macOS after the victim runs a supplied coding project, granting file operations, command execution, and data collection. PollCat adds persistence and secondary payload delivery under a one-hour time limit enforced by single-use six-digit codes. Both samples were first found in Afghanistan before variants appeared in the other two countries.

Technical artifacts show deliberate anti-AI measures, such as explicit instructions banning AI assistants in the assessment prompt, indicating the operators anticipated automated code review tools. This matches prior Mirage Kitten recruitment lures documented since 2022 and aligns with UNC1549 and Smoke Sandstorm reporting from other vendors. The focus on aerospace and fintech specialists in Africa and the Middle East follows the group's established geographic and sector priorities rather than random expansion.

Procurement and incident records reveal Iranian state-linked groups have sustained recruiter impersonation operations for at least three years, yet public reporting rarely cross-references these with specific malware samples or infrastructure reuse. Kaspersky's analysis supplies the first public hashes and behavioral details for these families, closing a gap left by earlier high-level threat bulletins.

Expect continued use of cloud storage for initial access and rapid iteration on the two families. Defenders should monitor for Azure subdomains containing known target names and block execution of unvetted archives labeled as technical assessments.