Dude, Where's My Alert?

A fake recruiter, a coding challenge, and a Node.js payload walk into a development environment. This week, we break down Mirage Kitten's NodeRabbit and PoleCat malware families, including Trojanized coding challenges, cross-platform persistence, proxy-aware command and control, malicious VS Code extensions, Git hooks, WSL abuse, and JavaScript execution. We also look at the return of exploit-kit style activity and why familiar technologies such as Node.js, JavaScript, curl, scheduled tasks, and legitimate developer tooling continue to give threat actors plenty of room to operate.

----------

Stay in Touch!
Twitter: https://twitter.com/Intel471Inc
LinkedIn: https://www.linkedin.com/company/intel-471/
YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg
Discord: https://discord.gg/DR4mcW4zBr
Facebook: https://www.facebook.com/Intel471Inc/