An Iranian state-linked hacking group tracked as Nimbus Manticore (also known as Mirage Kitten) is targeting software engineers with a new attack chain: fake recruiters on LinkedIn invite developers to complete a timed coding challenge, then deliver cross-platform malware hidden inside the project archive. Kaspersky researchers discovered two previously undocumented remote access trojans (RATs) used in these campaigns — NodeRabbit and PollCat — both written in Node.js and JavaScript so they run natively on Windows, Linux, and macOS from a single codebase. In one documented case, the victim received a ZIP file named “Front-Technical-Challenge.zip” from someone posing as a talent acquisition specialist at a major technology company, asking them to fix bugs in a project management tool called Taskflow. The real payload was hidden in a trojanized npm package called colorized_terminal bundled inside the archive’s node_modules directory — it silently launched the NodeRabbit implant as a detached background process when the candidate ran the project.
Once installed, NodeRabbit connects to Azure-hosted command-and-control servers and supports 11 commands covering file operations, process enumeration, and shell command execution. A second malware family, PollCat, was delivered via a different coding challenge styled as a React application with CTF (capture-the-flag) terminology — likely assembled with AI assistance by the attackers. PollCat supports 22 commands and specifically scans for installed security software from vendors including CrowdStrike, Sophos, SentinelOne, Kaspersky, and others, transmitting the results to the attackers. Both implants establish persistence through OS-appropriate mechanisms: a Windows registry run key, a cron entry on Linux, or a launch agent on macOS. Kaspersky links the campaigns to Nimbus Manticore based on structural similarities with the group’s previously documented MiniFast backdoor, and notes the group’s consistent use of recruiter personas to target critical sectors across the Middle East and Africa for espionage purposes.