Listen to this Post
A New Threat Hidden Behind a Job Opportunity
Cyberattacks do not always begin with suspicious websites, strange attachments, or obvious phishing emails. Increasingly, they can begin with something that looks completely legitimate: a message from a recruiter, a coding assessment, or an invitation to complete a technical challenge for a promising job.
That is the alarming strategy now associated with the Iranian hacking group Nimbus Manticore, which has been linked to two previously undocumented malware families known as NodeRabbit and PollCat. According to Kaspersky’s analysis, both are cross-platform remote access trojans built with Node.js and JavaScript, allowing the attackers to target Windows, Linux, and macOS environments through developer-focused lures.
Why Developers Are Becoming Attractive Targets
The significance of these discoveries goes beyond two new malware names. Nimbus Manticore appears to be adapting its tooling around the environments used by software engineers, where running unfamiliar source code, installing dependencies, testing applications, and downloading project archives are normal parts of the job.
That creates an unusually effective social-engineering opportunity. Instead of convincing a victim to open an obviously malicious executable, the attacker can persuade them to run a project they believe is part of a recruitment process.
NodeRabbit and PollCat Expand the Attack Surface
Kaspersky tracks the two malware families as NodeRabbit and PollCat. The first known NodeRabbit sample was found on a system in Afghanistan, while additional variants were subsequently identified on machines in Egypt and Ethiopia. Both families are designed as cross-platform RATs, although PollCat is specifically implemented as obfuscated JavaScript.
This represents an important evolution from Nimbus
The Malware Arsenal Is Growing
NodeRabbit and PollCat are not isolated additions to the group’s capabilities. The threat actor has also been associated with a Windows backdoor called NightLedger, the WebSocket tunneling tools BridgeHead and ArcBridge, a reverse SSH tunneling utility, and another backdoor with similarities to TWOSTROKE.
Taken together, these developments suggest a threat actor investing in multiple layers of access, communication, persistence, and remote control rather than relying on a single malware family.
The Fake Engineering Interview
One of the most revealing attacks began with a ZIP archive named Front-Technical-Challenge.zip. The file was hosted on AWS and was reportedly delivered as part of what appeared to be a legitimate engineering job opportunity.
The attacker allegedly posed as a talent acquisition specialist from a major technology company and approached a software engineer with an invitation to complete a technical assignment. The approach exploited a familiar professional interaction rather than an obviously malicious one.
The Iranian “Dream Job” Strategy
Nimbus Manticore is also known as Iranian Dream Job, a name associated with its use of recruitment-themed lures. The strategy is particularly dangerous because the victim is encouraged to participate voluntarily.
The technique resembles a broader pattern seen in state-linked cyber operations, including recruitment-themed attacks previously associated with the North Korea-linked Lazarus Group. The underlying idea is simple but powerful: transform the victim’s professional ambition into the mechanism that delivers the malware.
The Coding Challenge That Wasn’t What It Seemed
Inside the malicious archive was source code for a project-management application called Taskflow. Candidates were instructed to find and fix frontend bugs within three hours, while being told not to use AI-assisted coding tools.
That restriction could make the exercise feel more authentic, because real technical interviews sometimes impose limits on external assistance. In this case, however, the instructions helped keep the candidate focused on executing the supplied project.
The Server File Was the Trap
The challenge specifically instructed participants not to modify server.js, describing it as bug-free and functioning correctly.
That seemingly harmless instruction became one of the most important parts of the attack. The malicious component was embedded in the very server file candidates were told to leave untouched.
The Trojanized npm Package
The first line of server.js imported a maliciously modified npm package named colorized_terminal, version 2.1.0.
Rather than publishing the package to the public npm registry, the attackers placed it directly inside the archive’s local node_modules directory. When the package was imported, it silently launched an implant from a hidden cache path as a detached background process.
Why Local Dependencies Matter
This detail demonstrates why developers should never automatically trust dependencies simply because their names look familiar.
A project can contain its own local dependency tree, meaning the developer may install and execute code that never came from a package manager’s public repository during the actual installation process. In a recruitment scenario, a candidate may also assume that the archive has already been prepared and reviewed by the supposed employer.
NodeRabbit Establishes Remote Control
Once executed, NodeRabbit communicates with Azure-hosted command-and-control infrastructure. The analyzed sample used three C2 addresses and three primary API endpoints for registration, command retrieval, and command-result transmission.
The communication structure is straightforward: the compromised machine checks in, waits for instructions, executes those instructions, and returns the results to the operator.
NodeRabbit’s Command Capabilities
NodeRabbit supports 11 commands that allow its operators to collect host information, enumerate running processes and directories, execute arbitrary shell commands, read files, write data, delete files and directories, create directories, enumerate network adapters and addresses, inspect DNS settings, and modify its beacon interval.
That makes NodeRabbit more than a simple information stealer. It provides the attacker with a flexible remote-control mechanism that could potentially be used for reconnaissance, additional payload delivery, data access, and preparation for deeper intrusion.
Temporary Scripts and Trace Reduction
Another noteworthy feature allows NodeRabbit to write a Base64-encoded Node.js script into a randomly named temporary file, execute it, and then delete the file.
The design is significant because it provides the operator with a way to execute additional JavaScript functionality without leaving the temporary payload sitting openly on disk.
Three NodeRabbit Variants
Kaspersky identified two additional NodeRabbit variants in Egypt and Ethiopia, indicating that the malware is not a single static build.
One variant replaced colorized_terminal with another trojanized package called pretty-log, version 2.1.0. It also contained checks designed to terminate the malware in analysis environments and partially supported corporate proxy configurations. A third variant continued using pretty-log but changed the API structure used for C2 communication.
Cross-Platform Persistence
The
On Windows, it can use a Run registry key. On Linux, it can establish a cron entry. On macOS, it can use a launch agent. The mechanisms are designed to resemble legitimate software updates, including Microsoft Edge or Intel’s Driver & Support Assistant in some variants.
WSL Adds Another Layer
The third variant demonstrates that the attackers are also thinking about hybrid Windows and Linux development environments.
It can create a daily 10 a.m. Windows task that launches a Visual Basic Script through wscript.exe and wsl.exe, while also incorporating functionality specifically related to Windows Subsystem for Linux.
Searching for Developer Secrets
The
Most concerning for developers is its ability to search common locations for Git repositories and inject a launcher into Git hooks for persistence.
The Fake GitHub Copilot Helper Extension
The third NodeRabbit variant can also attempt to install a fake Visual Studio Code extension named GitHub Copilot Helper, accompanied by a Windows Run value for persistence.
The technique is particularly relevant because developer workstations increasingly rely on IDE extensions. A malicious extension that looks like a familiar productivity or AI-development tool could provide an attacker with an additional opportunity to blend into normal developer activity.
PollCat Arrives Through Another Coding Challenge
Nimbus Manticore has also used a second programming challenge lure, named RankChallenge-react-6uJSX3-main.zip, to distribute PollCat.
The archive was reportedly delivered through time-limited developer assessments, again combining professional pressure with technical tasks to encourage the target to execute the supplied project.
The Strange CTF References
The supposedly legitimate project repeatedly uses terminology associated with capture-the-flag security competitions.
Its root package is called ctf-server, the backend displays “CTF server running,” the frontend contains multiple ctf-related storage keys, and the tutorial references a CTF path. Kaspersky assessed these inconsistencies as potentially indicating that the project was AI-assisted or generated from a template before malicious functionality was inserted.
AI May Be Part of the Attack Pipeline
The possibility of AI-assisted malware development is one of the more interesting elements of the investigation.
Kaspersky did not establish that an AI system definitely created the malicious project. Instead, the repeated CTF terminology and inconsistencies were described as being consistent with an AI-assisted or template-generated application, with one possible explanation being that an attacker generated the basic React platform and subsequently inserted malicious code.
A Six-Digit OTP Creates False Trust
The PollCat campaign included a PDF tutorial instructing the target to click Continue and enter an attacker-provided six-digit one-time password that refreshed every 30 seconds.
The victim was also told to complete the challenge within a one-hour session. The compressed deadline likely served a psychological purpose: create urgency, reduce careful inspection, and encourage the target to run the application immediately.
The OTP Wasn’t Actually Protecting the Malware
The authentication process was largely a distraction from PollCat’s execution.
PollCat operated independently of whether the OTP validation succeeded or failed. A failed authentication prevented access to certain challenge features, while successful authentication generated a JWT and launched another PollCat instance.
PollCat Becomes a Full Remote Backdoor
PollCat establishes persistence on Windows, Linux, and macOS and then communicates with its C2 infrastructure to provide host information and await commands.
The malware supports 22 commands and uses seven documented API endpoints for beaconing, host information, command retrieval, command-result submission, file downloads, file uploads, and transfer tracking.
PollCat’s Remote-Control Arsenal
Its capabilities include file operations, shell execution, JavaScript execution, file uploads and downloads, DLL loading, ZIP creation and extraction, and enumeration of processes, drives, volumes, and mount points.
Three commands — WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST — were present but not implemented in the analyzed version.
Security Software Reconnaissance
PollCat also contains a hard-coded list of 24 software and security vendors, including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, Juniper Networks, Sophos, Symantec, Trend Micro, McAfee, Kaspersky, ESET, Bitdefender, Avast, CrowdStrike, SentinelOne, Malwarebytes, Brave, Tencent, and Naver.
The malware searches for folders associated with those products and inventories their root contents when a match is found. The collected information is then transmitted to the attacker’s infrastructure as JSON.
Why Security-Product Discovery Matters
This behavior could help operators understand the defensive environment surrounding an infected machine.
Knowing that security products or developer tools are present can influence how an attacker approaches a compromised system. It may also help distinguish high-value machines from ordinary endpoints and provide information about what security controls could interfere with later stages of an intrusion.
Linking PollCat to Nimbus Manticore
The attribution is not based simply on the malware’s use of recruitment lures.
Kaspersky identified similarities involving
A Single Codebase Changes the Equation
The most important strategic development may be the group’s move toward cross-platform scripting.
Instead of maintaining entirely separate malware implementations for different operating systems, a Node.js and JavaScript-based tool can provide a common development foundation across Windows, Linux, and macOS. Kaspersky specifically highlighted this ability to use a single codebase while blending payloads into developer workstations.
The Developer Workstation Is Becoming the New Battlefield
Modern engineering machines contain valuable information: source repositories, credentials, cloud configurations, SSH keys, package-management tokens, internal documentation, proprietary code, browser sessions, API credentials, and access to production infrastructure.
A malware family that gains a foothold on a developer’s workstation may therefore provide much more strategic value than a random compromised endpoint.
The Real Weapon Is Social Engineering
NodeRabbit and PollCat are technically capable, but their delivery mechanism may be the most dangerous component of the campaign.
A sophisticated RAT still needs execution. The fake job assessment solves that problem by making the victim believe that running the supplied code is necessary to obtain employment.
The attacker does not necessarily need to bypass the victim’s judgment. The attacker can instead manipulate the victim’s judgment into cooperating with the intrusion.
What Makes the Campaign So Convincing
The fake assessments contain familiar elements from real hiring processes: recruiter communication, technical assignments, project source code, deadlines, tutorials, authentication codes, and development environments.
Each individual element can appear harmless. Combined together, they create a believable narrative that can make an experienced developer overlook the most important question: Why should I execute code supplied by someone I have not independently verified?
Deep Analysis: The Commands Reveal the Attacker’s Priorities
Command 01 — Host Reconnaissance
NodeRabbit can collect information about the compromised host, giving operators an initial understanding of the machine and its environment.
Command 02 — Process Enumeration
The malware can list running processes, allowing attackers to understand what applications and services are currently active.
Command 03 — Shell Execution
NodeRabbit can execute arbitrary shell commands, turning an initial malware infection into a general-purpose remote-control channel.
Command 04 — File Collection
NodeRabbit can read files in chunks and return their contents using Base64 encoding, providing a mechanism for remote data collection.
Command 05 — File Modification
The malware can decode Base64 data and write it at a selected file offset, giving operators the ability to modify files remotely.
Command 06 — File and Directory Removal
NodeRabbit can delete individual files or recursively remove directories, creating both destructive and cleanup possibilities.
Command 07 — Network Reconnaissance
The malware can enumerate adapters, MAC addresses, IP addresses, and DNS settings to map the infected machine’s network configuration.
Command 08 — Temporary Script Execution
NodeRabbit can create a randomly named temporary Node.js script, execute it, and delete it afterward, providing a flexible mechanism for running additional code.
Command 09 — Git Repository Discovery
The third variant searches common development locations for Git repositories, placing source-code environments directly within its reconnaissance priorities.
Command 10 — Git Hook Persistence
The malware can inject a launcher into Git hooks, creating an unusual persistence mechanism that is particularly relevant to developer machines.
Command 11 — Outlook Artifact Collection
NodeRabbit can search Outlook OST and PST artifacts for account addresses, expanding reconnaissance beyond development tools into user and organizational information.
Command 12 — Fake Developer Extension
The malware can attempt to install a fake VS Code extension named “GitHub Copilot Helper,” illustrating how the attackers are adapting persistence and deception to developer workflows.
Command 13 — C2 Replacement
The third NodeRabbit variant can replace its active C2 server and attempt to preserve the new configuration, giving operators additional flexibility if infrastructure is disrupted.
Command 14 — Remote File Transfer
PollCat can retrieve files from attacker-controlled infrastructure and write them to the victim machine, while also uploading local files or chunks to the C2 server.
Command 15 — JavaScript Execution
PollCat can execute JavaScript remotely, an especially natural capability for malware already built around a JavaScript-based execution environment.
Command 16 — DLL Loading
PollCat supports DLL loading, providing another mechanism for extending the malware’s functionality after initial compromise.
Command 17 — Archive Operations
The malware can create or extract ZIP archives, which can simplify the movement or packaging of collected and delivered data.
Command 18 — Security Environment Discovery
PollCat searches for directories associated with numerous security vendors, providing operators with information about the defensive software installed on the endpoint.
Command 19 — Persistence Across Operating Systems
The malware can establish persistence differently on Windows, Linux, and macOS, demonstrating that the cross-platform strategy extends beyond simple execution.
Command 20 — Beaconing and Command Retrieval
Both malware families maintain communication with attacker-controlled infrastructure so the operators can receive information and issue additional instructions after the initial infection.
What Undercode Say:
A Recruitment Scam Has Become an Initial Access Platform
Nimbus
Developers Are Particularly Exposed
Software engineers routinely execute code obtained from external sources. That makes the normal behavior of development work itself a potential attack surface.
Trust Is Being Weaponized
The most dangerous element is the credibility of the scenario. A job opportunity creates a reason to download an archive, inspect source code, install dependencies, and run an application.
The Technical Challenge Creates Psychological Pressure
Deadlines, OTP timers, and one-hour sessions can prevent targets from slowing down and reviewing what they are executing.
“Do Not Modify This File” Is an Interesting Social Trick
Telling a developer that server.js is already correct may actually reduce scrutiny of the file, particularly when the developer’s assignment focuses on frontend bugs.
Local npm Dependencies Deserve More Attention
Developers often think of npm packages in terms of public registries and package-lock files. A malicious dependency bundled directly into an archive can evade that intuitive trust model.
Cross-Platform Malware Is a Strategic Upgrade
Node.js allows attackers to target multiple operating systems with a common technology stack. That can reduce development overhead while expanding the pool of potential victims.
macOS Is No Longer Outside the Conversation
The inclusion of macOS persistence through launch agents is particularly important because developer and executive environments frequently contain valuable corporate data.
Linux Developers Are Also in the Crosshairs
The use of cron persistence demonstrates that Linux workstations are being treated as viable targets rather than secondary platforms.
WSL Creates Hybrid Opportunities
Windows developers increasingly use Linux environments through WSL. Malware capable of understanding both sides can potentially operate across boundaries that users may perceive as separate.
Git Repositories Are High-Value Targets
The ability to locate repositories and manipulate Git hooks shows that the attackers are interested in the development workflow itself.
Source Code Could Be More Valuable Than the Endpoint
A compromised developer machine can potentially provide access to intellectual property, private repositories, build systems, cloud environments, and internal infrastructure.
Fake Extensions Are a Natural Next Step
Developers routinely install IDE extensions. A malicious extension that resembles a trusted AI coding assistant can exploit that established behavior.
Security Software Discovery Is a Warning Sign
PollCat’s search for directories associated with major security vendors suggests that understanding the defensive environment is part of the malware’s reconnaissance process.
The Malware Is Built for Follow-Up Operations
NodeRabbit and PollCat are not simple one-purpose implants. Their command sets provide the operators with flexibility after the initial compromise.
The C2 Architecture Is Modular
Separate endpoints for registration, task retrieval, result submission, and file transfer provide a structured command-and-control workflow.
Infrastructure Can Change
The ability of one NodeRabbit variant to replace its active C2 configuration means defenders cannot assume that blocking a single server permanently neutralizes the malware.
The Attack Does Not Depend on Successful Authentication
PollCat’s independence from the fake OTP validation is especially revealing. The authentication mechanism is primarily part of the deception rather than a prerequisite for the malware’s existence.
AI Could Accelerate Attacker Development
Kaspersky’s observation about potentially AI-assisted or template-generated project code points toward a broader trend in which attackers can rapidly create convincing technical environments.
AI Also Creates Defensive Opportunities
The same inconsistencies that may indicate generated code can potentially become detection signals. Unusual project naming, contradictory instructions, unnecessary CTF references, and mismatched architecture can all deserve additional scrutiny.
Cloud Services Can Hide in Plain Sight
Using Azure-hosted infrastructure means malicious communications can be hosted on mainstream cloud infrastructure rather than relying exclusively on obviously suspicious servers.
Cloud Hosting Does Not Make the Malware Legitimate
A project hosted on AWS or malware communicating through Azure remains malicious if the payload and behavior are hostile. Familiar infrastructure can be part of the disguise.
Recruitment Verification Is Essential
Candidates should independently verify recruiters and companies before executing technical assignments, particularly when the assessment requires running local code.
Developers Need a Separate Assessment Environment
Technical challenges from unknown sources should ideally be executed in isolated virtual machines or disposable environments rather than on machines containing credentials and proprietary repositories.
Dependencies Should Be Audited
A developer should inspect package manifests, lockfiles, dependency paths, and unfamiliar local modules before executing an externally supplied project.
“Run This Project” Should Trigger Suspicion
Running an application is fundamentally different from reading source code. A technical assessment that requires execution deserves substantially more scrutiny than a static coding exercise.
Time Pressure Is a Red Flag
Legitimate hiring processes can have deadlines, but an unusually compressed window combined with OTP instructions should encourage additional verification rather than immediate execution.
The Industry Needs Better Hiring Security
Companies that legitimately distribute coding assessments should recognize that attackers can imitate the process. Candidates need reliable ways to verify whether an assessment actually originated from the company.
Endpoint Security Must Understand Developer Behavior
Traditional malware detection is not enough when the payload is hidden inside a legitimate-looking Node.js project. Security systems need visibility into unusual dependency execution, persistence, Git manipulation, and developer-tool abuse.
The Threat Is Bigger Than Two Malware Families
NodeRabbit and PollCat are important because they represent a broader direction: attackers are increasingly designing malware around the applications, operating systems, and habits of specific professional communities.
Nimbus Manticore Is Adapting to Modern Workflows
The
The Most Dangerous Malware May Look Like Work
A malicious executable looks suspicious. A fake coding challenge looks productive.
That difference is exactly what makes this campaign so effective.
Developer Awareness Is Now a Security Control
Training should cover more than phishing links and suspicious attachments. Developers need to understand that source archives, npm dependencies, IDE extensions, Git hooks, technical tests, and recruiter messages can all become infection vectors.
The Final Lesson Is Simple
The strongest defense against this style of operation is not refusing every technical assignment. It is verifying the source, isolating execution, auditing dependencies, and refusing to allow professional urgency to override basic security hygiene.
✅ Supported: Kaspersky attributed the newly documented NodeRabbit and PollCat malware families to activity associated with Nimbus Manticore and described both as cross-platform RATs distributed through trojanized coding challenges.
✅ Supported: The supplied source documents Windows, Linux, and macOS persistence techniques, extensive remote-control capabilities, Git-related functionality, and security-product reconnaissance associated with the malware variants.
❌ Not established: The source does not prove that an AI system created the malicious project; Kaspersky presented AI-assisted or template-generated development as one possible explanation for the project's unusual CTF terminology and inconsistencies.
Prediction
(+1) Cross-Platform Targeting Will Likely Increase
Nimbus Manticore’s move toward Node.js and JavaScript suggests that cross-platform malware will remain attractive to operators targeting developers. A shared technology stack can simplify maintenance while expanding the number of operating systems that can be attacked.
(+1) Fake Coding Tests Will Become More Convincing
Recruitment-themed attacks are likely to become harder to distinguish from genuine hiring exercises as attackers improve project quality, recruiter impersonation, documentation, authentication flows, and technical assignments.
(+1) Developer Tools Will Receive More Attention
VS Code extensions, Git repositories, package managers, CI/CD environments, and development credentials represent attractive targets. Malware that understands these environments can provide attackers with access far beyond a single workstation.
(+1) AI-Assisted Malicious Development May Accelerate
If attackers increasingly use AI coding assistants to generate application frameworks before inserting malicious components, security teams may face a growing number of realistic-looking projects that can be produced quickly and customized for individual victims.
(-1) Traditional Trust in Cloud Infrastructure Will Become Less Reliable
Attackers can use mainstream cloud services and familiar platforms as part of their infrastructure. As a result, defenders will need to evaluate behavior and context rather than treating well-known cloud providers as inherently trustworthy.
(-1) Developer Workstations Will Remain a High-Value Weak Point
A compromised developer endpoint can potentially expose source code, credentials, repositories, internal applications, and cloud resources. Without stronger isolation, these machines will continue to provide valuable entry points for espionage campaigns.
The Bigger Cybersecurity Warning
The emergence of NodeRabbit and PollCat is a reminder that modern cyberespionage is increasingly about understanding the victim’s routine.
Nimbus Manticore’s operators are not simply delivering malware. They are constructing believable professional experiences around it. The recruiter, the coding test, the project archive, the deadline, the OTP, the development framework, and even the apparent software dependencies all contribute to the same story.
And that story has one dangerous objective: make the victim believe that running malicious code is simply part of doing their job.
For developers, the lesson is especially important. A repository is not automatically safe because it looks professional. A recruiter is not automatically legitimate because the message arrives through a trusted platform. A package name is not automatically trustworthy because it resembles a familiar npm dependency. And an urgent technical assessment should never be allowed to eliminate basic security checks.
The most important change Nimbus Manticore’s latest activity reveals is therefore not simply the creation of two new RATs. It is the fusion of social engineering, developer workflows, cross-platform scripting, persistence, cloud infrastructure, and remote access into one increasingly convincing attack chain.
That is what makes NodeRabbit and PollCat worth watching — and why the modern developer workstation should now be treated as one of the most valuable targets in the cyberespionage battlefield.
Fix the analysis section headings
Replace the twenty-command repetition
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
