Iranian state-linked hackers are disguising malware-laced coding challenges as job recruitment tests, delivering. Cross-platform remote access trojans (RATs) to software engineers in Afghanistan, Egypt. And Ethiopia. According to Kaspersky research published on September 1, 2026, the threat group known as Nimbus Manticore has expanded beyond its traditional Windows focus to deploy two previously undocumented malware families — NodeRabbit and PollCat — written in Node.js and obfuscated JavaScript. This guide covers Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through. Coding Tests in detail. This guide covers Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through. Coding Tests in detail. You can also read Cursor Defies SpaceX Takeover by Refusing to Merge With xAI Coding Tools. You can also read TikTok to Pay Record $400 Million in Landmark Child Privacy Settlement with DOJ.
Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests: How. Does the Nimbus Manticore Attack Chain Work?
The operation begins on LinkedIn and other job platforms. Where attackers posing as talent acquisition specialists at a major technology company approach software engineers. Targets receive a ZIP file hosted on AWS named "Front-Technical-Challenge.zip," framing the interaction as a legitimate engineering assignment for an engineering role. Candidates are instructed to "find and fix all bugs in the frontend code" within three hours, with explicit warnings not to use AI-assisted tools and not to modify the server.js component, which the attackers claim is "bug-free and functions correctly."
That file is exactly where the malicious payload hides. The first line of server.js imports a trojanized npm package called colorized_terminal version 2.1.0, which is bundled directly in the archive's node_modules directory rather than being published to the npm registry. According to Kaspersky security researcher Omar Amin, when the package is imported, it silently launches an implant from node_modules/.cache/.320697f1/index.js as a detached background process — a technique that bypasses typical developer scrutiny.
What Makes NodeRabbit and PollCat Different from Previous Nimbus Manticore Tools?
Historically, Nimbus Manticore — tracked separately as "Iranian Dream Job" for its recruitment-themed lures. Relied on malware written in C, C++. And Go, often deployed via DLL search-order hijacking. The shift to Node.js-based cross-platform RATs signals an evolution that broadens the group's reach to Linux and macOS systems. The first NodeRabbit sample was discovered in Afghanistan, with additional infections detected in Egypt and Ethiopia.
NodeRabbit communicates with three Azure-hosted command-and-control endpoints — plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, and wslwebui.azurewebsites[.]net — using API routes at /api/rabbit/checkin, /api/rabbit/task, and /api/rabbit/result. The malware supports 11 commands that let operators gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read files in chunks as Base64-encoded data, and decode Base64 text to write files at chosen paths. PollCat, the second implant, follows the same delivery model but is built entirely in obfuscated JavaScript.
Why Does This Matter for Software Engineers and Security Teams?
For developers, this campaign exposes a dangerous blind spot: vetting third-party npm packages bundled inside "offline" archives rather than pulled from the registry. Because the malicious colorized_terminal package was never published to npm, dependency-scanning tools that only check registry-sourced code will miss it. Security teams should treat any recruiter-supplied code archive as untrusted, inspect the node_modules tree manually before execution, and isolate such projects in throwaway virtual machines or containers.
Organizations that hire engineers should also note. That attackers are weaponizing brand impersonation on professional networks, mirroring tactics long associated. With North Korea's Lazarus Group. A practical mitigation: require coding assessments to be completed inside a managed, monitored. Platform owned by the employer, never on. The candidate's personal machine using attacker-supplied archives.
What This Means for the Broader Threat Landscape
Nimbus Manticore's pivot to cross-platform JavaScript implants is part of a broader arsenal expansion. Kaspersky's recent reporting also attributes a Windows backdoor called NightLedger, two custom WebSocket. Tunnelers named BridgeHead and ArcBridge, a reverse SSH tunneling tool. And a backdoor overlapping with the TWOSTROKE family to the same actor. The diversification of languages and platforms makes detection harder a Whether you are new to Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests or already experienced, the sections below have you covered.nd signals that the group is investing in long-term, multi-OS espionage capabilities rather than one-off operations.
What's Next
Expect more recruitment-themed spear-phishing on LinkedIn, GitHub. And developer forums as Iranian and other state-aligned groups refine this approach. Defenders should watch for new trojanized npm packages distributed outside the public registry. Monitor Azure App Service domains for suspicious outbound traffic. And audit any code challenge archives received from external recruiters before running them.
Key Points
Nimbus Manticore delivered NodeRabbit and PollCat RATs via fake coding tests on LinkedIn
First infections observed in Afghanistan, Egypt, and Ethiopia
Malicious code hidden in server.js via bundled npm package colorized_terminal v2.1.0
C2 infrastructure hosted on three Azure App Service domains using /api/rabbit endpoints
The Bottom Line
A coding challenge from a recruiter is now one of the most effective. Ways for Iranian state hackers to compromise. Software engineers across Windows, Linux. And macOS. And traditional dependency scanning will not catch it.
FAQ
What is Nimbus Manticore and what does it target?
Nimbus Manticore is an Iranian state-linked hacking group that targets software engineers through fake recruitment schemes, now deploying cross-platform RATs written in Node.js and JavaScript.
How does the NodeRabbit malware get installed?
NodeRabbit is installed when a developer runs a recruiter-supplied coding challenge archive that bundles a malicious npm package called colorized_terminal, which silently launches the implant.
Which countries have been affected by the Nimbus Manticore campaign?
Kaspersky confirmed NodeRabbit infections on systems located in Afghanistan, Egypt, and Ethiopia.
Related Re Keep this reference handy whenever you work with Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests.sources
For more context, check our related article on Cursor Defies SpaceX Takeover by Refusing to Merge With xAI Coding Tools.
