As reported by The Hacker News, the Iranian threat actor Nimbus Manticore (also tracked as "Iranian Dream Job") has deployed two new cross-platform remote access trojans — NodeRabbit and PollCat — using trojanized coding challenge archives delivered through fake recruitment lures on LinkedIn and other job platforms. Kaspersky's research reveals a significant evolution in the group's tradecraft: a move from Windows-centric C/C++ and Go payloads to Node.js and JavaScript-based RATs capable of infecting Linux and macOS systems.
Why This Matters
This development is significant for three reasons. First, the shift to cross-platform JavaScript payloads dramatically expands the attack surface. Organizations that have historically considered macOS and Linux endpoints lower-risk for nation-state malware must recalibrate. Second, the recruitment lure remains one of the most effective initial access vectors because it exploits a genuine human motivation — career advancement — that is difficult to suppress through policy alone. Third, the group's instruction to candidates to avoid AI-assisted tools is a notable social engineering refinement designed to prevent automated code review from flagging the malicious server.js file.
The attackers specifically instruct candidates not to modify server.js, claiming it is "bug-free" — precisely where the malicious code resides.
Who Is at Risk
Broader Implications
The rapid expansion of Nimbus Manticore's arsenal — now including the NightLedger Windows backdoor, BridgeHead and ArcBridge WebSocket tunnelers, a reverse SSH tunneling tool, and overlaps with TWOSTROKE — suggests an operationally resourced and actively developing threat group. The move to Node.js payloads is particularly concerning because JavaScript runtime environments are ubiquitous in developer workflows, making malicious activity harder to distinguish from legitimate development activity. The use of AWS-hosted archives further blends malicious infrastructure with trusted cloud services.
Shield53 Recommendations
For Security Teams:
- Deploy EDR coverage on macOS and Linux developer endpoints — not just Windows. Monitor for Node.js processes making unexpected outbound network connections, especially from non-standard working directories
- Create detection rules for unusual
nodeprocess execution from temporary directories, Downloads folders, or extracted archive locations - Block and alert on archive files (
.zip) downloaded from AWS S3 buckets that contain executable JavaScript with obfuscated content - Implement egress filtering to detect WebSocket tunneling and reverse SSH connections consistent with BridgeHead, ArcBridge, and the group's reverse SSH tool
- Brief engineering teams on this specific recruitment lure pattern: fake recruiters from major tech companies sending coding challenges via LinkedIn with instructions to avoid modifying server-side files
For Developers and Engineering Staff:
- Verify any recruitment outreach through official company channels before engaging with coding challenges
- Never execute code from untrusted archives without first reviewing all files — including server-side files that instructions tell you to ignore
- Run coding challenges inside isolated VMs or containers rather than on your primary workstation
- Use AI-assisted code review tools on challenge files despite instructions not to — malicious actors specifically try to prevent this because automated tools may flag their payloads
The fact that attackers explicitly instruct candidates to avoid AI tools is itself a strong indicator of malicious intent. Legitimate employers have no reason to prevent candidates from using static analysis or AI-assisted review on take-home challenges. That instruction alone should trigger heightened scrutiny.
