A newly uncovered operation by the Iranian hacking group Nimbus Manticore is using fake recruiter profiles and coding challenges to infect Linux, macOS, and Windows systems with custom remote access trojans (RATs). Two newly described malware families, NodeRabbit and PollCat, are at the heart of this campaign, marking a dangerous expansion of the group’s toolset.
How the Operation Works
The attackers pose as talent acquisition professionals at prominent tech firms and reach out to software engineers via LinkedIn and job-search platforms. Their pitch: complete a coding test as part of an interview process. One version involves a ZIP file labeled “Front-Technical-Challenge.zip,” instructing candidates to debug a frontend project called Taskflow. The catch: the server component file, ‘server.js,’ which applicants are told is “bug-free,” actually contains embedded malicious code that unleashes a RAT. This approach makes the malware delivery appear innocent, blending in naturally with a recruiting or interview workflow. The archive also contains a trojanized npm package—either “colorized_terminal” or “pretty-log”—bundled directly in the challenge, bypassing npm’s public registry.
What NodeRabbit and PollCat Can Do
NodeRabbit, delivered via one of the npm packages, launches a hidden implant after importing the trojanized module. It communicates with command-and-control (C2) servers hosted on Microsoft Azure, using endpoints like /api/rabbit/checkin and /api/rabbit/task to manage hosts, execute commands, list files and processes, delete directories, and more. Different variants have been identified in machines in Afghanistan, Egypt, and Ethiopia, each with slight tweaks to persistence strategies and proxy awareness.
PollCat uses similar tactics but delivers a different RAT under the guise of a CTF-style React application. Its challenge archive is restricted behind a two-factor OTP prompt, though the RAT itself activates independently of the OTP flow. PollCat supports dozens of commands—file operations, shell execution, uploading/downloading content, and other actions typical of espionage malware. It also scans for folder names associated with major security vendors and development tools, collecting system metadata and transmitting it back to C2 servers via several API endpoints.
The Bigger Picture
This isn’t Nimbus Manticore’s first rodeo. Earlier campaigns included malware written in native languages like C, C++, or Go, and deployment techniques such as DLL hijacking. What’s new here is the cross-platform reach: one codebase that works across Windows, Linux, and macOS. The method—fake engineering tests laced with malware—echoes tactics used by other advanced groups, including ones from North Korea, but the malware itself shows novelty in persistence and stealth. For example, on Windows the RAT may install registry Run keys, while on macOS and Linux it uses cron jobs or launch agents.
Targets seem focused on critical sectors across the Middle East and Africa. The engineering test ruse, combined with compressed timelines (some tasks require completion in just hours), is designed to pressure victims into executing code with minimal scrutiny. Even when the OTP fails, the RAT may activate regardless—showing how authentication barriers are being subverted.
What to Watch
Security teams should be alert for job or recruitment messages inviting technical challenges without clear oversight. Downloaded ZIP files offering sample projects or interview challenges that include an undeclared or obfuscated server component are red flags. Checking dependencies bundled locally (in node_modules) rather than via known public registries can help catch trojanized packages. Also watch for scheduled tasks, cron entries, or launch agent files that mimic legitimate software updates (e.g. browser or driver tools).
Why this matters: This campaign shows how state-linked threat actors are evolving faster than ever. Cross-platform RATs reduce overhead for attackers, letting them expand their reach with one malware family rather than maintaining multiple. The faux recruitment bait is particularly insidious: it lures trust with a veneer of legitimacy. Going forward, organizations must strengthen vetting of external code challenges and keep a sharp eye on seemingly benign developer workflows, which are now a growing front in cyber espionage.
