Iranian Hackers Target Engineers With Cross-Platform RATs via Fake Coding Tests

The Iranian state-aligned threat group Nimbus Manticore, also tracked as "Iranian Dream Job," has been linked to two previously undocumented cross-platform remote access trojans called NodeRabbit and PollCat. Researchers at Kaspersky say the malware families are written in Node.js and obfuscated JavaScript, signaling a notable departure from the group's historical reliance on C, C++, and Go-based tools. The discovery marks Nimbus Manticore's expansion into cross-platform tradecraft capable of infecting Linux and Apple macOS systems alongside Windows. The first NodeRabbit sample surfaced on a machine in Afghanistan, with additional infections detected in Egypt and Ethiopia.

The threat actor delivers its payloads through elaborate spear-phishing campaigns on LinkedIn and other job platforms, impersonating talent acquisition specialists at major technology companies. Targets—typically software engineers—are lured into downloading a ZIP archive named "Front-Technical-Challenge.zip," hosted on AWS, framed as a technical assignment requiring them to debug a project management application called Taskflow within a three-hour window. Candidates are explicitly told not to use AI-assisted tools and warned against modifying "server.js," which the attackers falsely claim is "bug-free." Anyone who falls for the ruse can verify whether their systems have been exposed using a port scanner to audit unexpected outbound connections.

Hidden inside the archive is a trojanized npm package dubbed "colorized_terminal" (version 2.1.0), bundled directly into the challenge's node_modules folder. The malicious code, embedded in the first line of server.js, executes the RAT payload once the candidate runs the application locally. PollCat follows the same delivery model but relies entirely on obfuscated JavaScript, broadening the group's ability to compromise diverse operating environments. Given the targeting of professional credentials and developer environments, affected engineers should immediately audit their accounts with a password checker and rotate any secrets that may have been stored on compromised machines.

The campaign is part of a broader acceleration in Nimbus Manticore's arsenal, which in recent months has also grown to include a Windows backdoor named NightLedger, two custom WebSocket tunnelers (BridgeHead and ArcBridge), a reverse SSH tunneling tool, and a backdoor sharing code overlaps with TWOSTRAKE. The recruitment-lure tactic mirrors the long-running playbook of the North Korea-linked Lazarus Group and underscores how professional networking platforms have become a primary attack surface for nation-state espionage. Organizations are urged to verify recruiter identities through out-of-band channels and to inspect any unsolicited code repositories with a email breach checker before execution.