Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests
Summary: Kaspersky attributed two new cross-platform RATs, NodeRabbit and PollCat, to the Iranian Nimbus Manticore group, which delivers them through LinkedIn recruiter personas and trojanized coding-challenge archives; NodeRabbit samples were found on machines in Afghanistan, Egypt, and Ethiopia. NodeRabbit is a Node.js implant launched from a bundled npm package named colorized_terminal in server.js, supporting 11 commands and three Azure-hosted C2 addresses, while PollCat is obfuscated JavaScript with 22 commands and seven API endpoints that searches for folders matching 24 security and software vendor names.
Key Takeaway: The lure is a coding test that asks candidates not to touch server.js because it is 'bug-free' - and that is exactly where the implant sits, so a developer running the challenge on a work machine infects it directly. PollCat inventories folders for CrowdStrike, SentinelOne, Palo Alto Networks and 21 other vendors, which tells you the operators are mapping what defenses are present before they act.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026