Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

Summary

The Iranian Nimbus Manticore hacking group is using spear-phishing on job platforms to deliver new cross-platform RATs, NodeRabbit and PollCat, written in Node.js and JavaScript. These RATs target Linux and macOS systems and are delivered via trojanized coding challenge archives, with malicious code embedded in a seemingly legitimate project's server file.

Full text

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests Ravie LakshmananSep 01, 2026Malware / Cyber Espionage The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Russian cybersecurity company Kaspersky is tracking the malware strains under the names NodeRabbit and PollCat. The first sample of NodeRabbit was discovered on a system in Afghanistan, with subsequent sightings on two distinct machines located in Egypt and Ethiopia. "Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives," Kaspersky security researcher Omar Amin said. "Like NodeRabbit, PollCat is a cross-platform RAT, but it is written in obfuscated JavaScript also distributed through trojanized coding challenge archives." While Nimbus Manticore has historically employed malware written in C, C++, and Go, and relied on DLL search-order hijacking techniques to deploy them, the latest findings mark the threat actor's foray into cross-platform tools to accomplish its goals. The development also comes amid a rapid expansion of the hacking group's malware arsenal in recent months, including - A Windows backdoor called NightLedger Two custom WebSocket tunnelers, BridgeHead and ArcBridge A reverse SSH tunneling tool A backdoor that shares overlaps with TWOSTROKE The starting point of the suspicious activity observed in the Afghanistan-based system starts with a ZIP file ("Front-Technical-Challenge.zip") hosted on AWS that's assessed to have been delivered as part of a job opportunity for an engineering role. The threat actor is said to have masqueraded as a talent acquisition specialist at a major technology company to approach a software engineer and invited them to complete a technical assignment. It's worth noting that Nimbus Manticore is also tracked under the moniker Iranian Dream Job for its use of recruitment-themed lures to trick prospective targets into infecting their own computers, a tactic long adopted by the North Korea-linked Lazarus Group. The archive contains source code for a project management tool called Taskflow and instructs candidates to "find and fix all bugs in the frontend code" as part of an "engineering challenge" within three hours and without relying on artificial intelligence (AI)-assisted tools. The instructions specifically ask the candidates to refrain from modifying the server component of the application ("server.js"), claiming it's "bug-free and functions correctly." However, it's in this file that the malicious code is embedded. "The first line of server.js imported a trojanized npm package named colorized_terminal, version 2.1.0," Kaspersky said. "The attackers bundled the package directly in the challenge task archive's node_modules directory rather than publishing it to the npm registry. When imported, the package silently launched an implant from node_modules/.cache/.320697f1/index.js as a detached background process." The implant in question is NodeRabbit, which communicates with one of three Azure-hosted command-and-control (C2) addresses ("plugplay.azurewebsites[.]net," "rgbteller.azurewebsites[.]net," and "wslwebui.azurewebsites[.]net") through three distinct API endpoints - /api/rabbit/checkin, to register agent and host information /api/rabbit/task, to poll for commands /api/rabbit/result, to send task results The malware supports 11 commands that allows it to gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks and return Base64-encoded data, decode Base64-encoded text and write it at a chosen file offset, delete a file or recursively delete a directory, create directories recursively, enumerate adapters, MAC addresses, IP addresses, and DNS settings, and alter beacon interval. Another notable capability of NodeRabbit is to write a Base64-encoded Node.js script to a randomly named ".tmp" file, execute it, and then delete it to cover up traces of malicious activity. Kaspersky said it identified two more variants of NodeRabbit that share the same code lineage, each recovered from Egypt and Ethiopia - A second variant that uses a different trojanized npm package named pretty-log (version 2.1.0) instead of colorized_terminal, while also terminating if found to be running in an analysis environment and partially implementing corporate proxy support A third variant that's also launched using the pretty-log npm package but uses a different set of API endpoints to accomplish the same tasks - /sdk/v2/ready /sdk/v2/config /sdk/v2/events Persistence is achieved depending on the operating system: a Windows Run registry key on Windows, a cron entry for Linux, and a launch agent on macOS. The persistence mechanism mimics either a Microsoft Edge browser update (first variant) or Intel's Driver & Support Assistant (second variant). The third variant, on the other hand, does not impersonate any legitimate software, but also takes into account the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. Windows task that launches a Visual Basic Script file through wscript.exe and "wsl.exe." In addition, it features 12 new commands to - Enumerate accessible Windows drive letters or WSL-mounted drives Execute a process Kill process by PID or image name Replace the active C2 server and attempt to keep the new configuration Return the current C2 server Harvest account addresses from Outlook OST and PST artifacts Attempt to install a fake VS Code extension named "GitHub Copilot Helper" and Windows Run value for added persistence Check selected VS Code, scheduled-task, and Run-key persistence indicators Remove the fake extension Search recent and common development locations for Git repositories Inject a launcher into a repository's Git hooks for added persistence Remove the marked Git-hook launcher Nimbus Manticore has also been observed using programming challenge lures ("RankChallenge-react-6uJSX3-main.zip") distributed via time-limited developer assessments to deliver PollCat. "Although the visible exercise is not a security CTF, the project uses CTF terminology in several places," Kaspersky said. "The root package is named ctf-server, the backend prints CTF server running, the frontend uses several ctf-* storage keys, and the tutorial refers to path/to/ctf." "These repeated labels, together with instructions that do not fully match the delivered application, are consistent with an AI-assisted or template-generated project. One possible explanation is that the attacker prompted an AI coding assistant to create a CTF-style React platform and later inserted the malicious components." A PDF tutorial present within the archive prompts the target to click Continue and enter an attacker-supplied six-digit one-time password (OTP) that's refreshed every 30 seconds, and complete the challenge within a one-hour session. The compressed timeline to activate the assessment is likely an attempt to create a false sense of urgency and make them run the project as soon as possible to increase the likelihood of an infection. Despite the one-hour session window, PollCat runs independently of the OTP authentication process, unaffected by the success or failure of the OTP validation step. A failed validation prevents the victim from accessing the protected challenge features, while a successful OTP validation issues a JWT and starts an additional PollCat instance. For persistence, the malware creates a daily scheduled task on Windows, Linux, or macOS, and then connects to a C2 server to send basic host information and await further instructions. It supports 22 commands and communicates via seven API e

Indicators of Compromise

• domain — plugplay.azurewebsites.net
• domain — rgbteller.azurewebsites.net
• domain — wslwebui.azurewebsites.net

Entities