How to remove PollCat RAT from the operating system

What kind of malware is PollCat?

PollCat is a Remote Access Trojan (RAT) written in obfuscated JavaScript. It gives attackers remote control over infected computers, letting them run commands, steal files, manage processes, and execute additional code. PollCat is cross-platform and works on Windows, Linux, and macOS.

Kaspersky researchers discovered PollCat while investigating Mirage Kitten, an Iran-linked cyberespionage group also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore. According to a summary by PolySwarm, the group delivers PollCat to software developers through fake job offers and trojanized coding challenges.

More about PollCat

Mirage Kitten has a long history of targeting strategically important organizations, particularly in the Middle East and in the aerospace, aviation, and defense sectors. The campaign involving PollCat focused on fintech, aviation, and aerospace, with targets in the Middle East and Africa, including Egypt, Ethiopia, and Afghanistan.

PollCat and its sibling NodeRabbit are the first publicly documented Mirage Kitten malware based on JavaScript and Node.js. Since developers run JavaScript projects every day, a JavaScript RAT hidden in a coding project draws far less attention than an unfamiliar program would.

PollCat registers with its Command and Control (C2) server as soon as the infected application starts and then keeps checking in (polling) for new commands. Its infrastructure runs on Microsoft Azure and attacker-controlled domains, and is designed to look like legitimate organizational traffic.

PollCat's features

PollCat declares 22 commands, three of which are not implemented. The working ones let operators browse folders, read, write, and manage files, execute shell commands, and list or kill running processes. The malware can also transfer files between the victim's device and the attackers, and pack files into ZIP archives, which makes stealing documents in bulk easier.

On Windows, PollCat can run DLL files and launch processes hidden from the user. Moreover, a command called EVAL_JS lets operators run any JavaScript code they want on the infected machine, so the RAT's functionality can be extended at any time without delivering a new version.

Security software check

PollCat includes a SYSTEM_CHECK function that searches the computer for folders belonging to 24 security and technology vendors. The list includes Microsoft, Palo Alto Networks, Cisco, Fortinet, CrowdStrike, SentinelOne, Sophos, Symantec, McAfee, Kaspersky, ESET, Bitdefender, and Malwarebytes.

This check tells the operators which security products are present on the device. With this information, they can decide how carefully to proceed, or whether the machine is worth pursuing at all.

Persistence

To survive reboots, PollCat sets up persistence that differs by operating system. On Windows, it creates scheduled tasks. On Linux, it adds cron entries, and on macOS it relies on both cron and LaunchAgent mechanisms. In each case, the malware starts again automatically, even after the victim closes the coding project.

Conclusion

PollCat lets attackers take control of infected computers, run commands, steal files, and execute arbitrary code, all while checking which security products might catch it. Since it runs on Windows, Linux, and macOS and restarts itself through scheduled tasks, cron, or LaunchAgents, it can quietly remain on a developer's machine for a long time. PollCat should be removed immediately.

More examples of RATs are SnakeBiteAgent, PackClient, and E4del.

How did PollCat infiltrate my computer?

PollCat is distributed through fake job offers. The attackers pose as recruiters on LinkedIn and job-search platforms, contact software engineers about development roles, and then send them a technical assessment to complete - a coding project that has been tampered with.

One such lure, RankChallenge-react, was a React code-fixing exercise protected by one-time password (OTP) authentication controlled by the attackers. The login step is just for show. PollCat registers with its C2 server and starts polling for commands as soon as the application starts, before the victim even enters the OTP.

To rush victims, the fake recruiters used one-hour assessment windows, and the campaign also told candidates not to use AI assistants, likely so that no AI tool would review the code and notice the malicious part. The same campaign delivered the NodeRabbit RAT through malicious npm packages hidden in other coding projects.

Keep in mind that RATs are also commonly spread through phishing emails, malicious attachments and links, fake download websites, malicious advertisements, pirated software, and software cracks.

How to avoid installation of malware?

Treat unsolicited job offers with caution, especially when a "recruiter" sends a project to download and run under a strict time limit. Review unfamiliar code before running it, and consider using an isolated virtual machine for coding tests from unknown companies instead of your main work computer.

In general, do not open attachments or links in unexpected emails and messages, download software only from official sources, and avoid pirated programs and cracks. Keep your operating system and applications up to date, and use reputable security software. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is PollCat?
• STEP 1. Manual removal of PollCat malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with PollCat malware, should I format my storage device to get rid of it?

Reformatting would get rid of PollCat, but it also erases all data on the drive. It is better to start with a scan using a trusted security tool like Combo Cleaner and keep formatting as a last resort.

What are the biggest issues that PollCat malware can cause?

PollCat allows attackers to run commands, steal files, and execute any code they choose on the infected computer. This can result in stolen work documents and source code, compromised accounts, additional malware infections, and a broader breach of the victim's workplace network.

What is the purpose of PollCat malware?

The purpose of PollCat is to give the Mirage Kitten group remote control over developers' computers for espionage, allowing them to collect files, run commands, and deploy further payloads without the victim noticing.

How did PollCat malware infiltrate my computer?

PollCat has been spread through fake job offers on LinkedIn and job-search platforms. Victims were sent trojanized React coding challenges, such as RankChallenge-react, which launched the RAT as soon as the project started, even before the victim logged in with the provided one-time password.

Will Combo Cleaner protect me from malware?

Combo Cleaner can detect and eliminate most known malware infections. That said, sophisticated threats like PollCat may hide deep within the system, so it is important to run a full system scan.