Nimbus Manticore Deploys RATs Through Trojanized Coding Challenges
Kaspersky has attributed two previously undocumented remote access trojans, NodeRabbit and PollCat, to the Iranian threat group Nimbus Manticore. The group delivered the cross-platform malware through trojanized coding-challenge archives sent to software engineers via recruiter-themed spear-phishing on LinkedIn and other job-search platforms.
The implants are written in Node.js and obfuscated JavaScript and are designed to run on Windows, Linux and macOS. Kaspersky identified the first NodeRabbit sample in Afghanistan, followed by related variants on systems in Egypt and Ethiopia. The findings extend a toolset that had historically used malware written in C, C++ and Go.
Malicious code embedded in developer assignments
One archive, named Front-Technical-Challenge.zip, was hosted on AWS and presented as an engineering assessment from a purported talent-acquisition specialist at a major technology company. It contained source code for a project-management application called Taskflow and instructed the recipient to fix frontend bugs within three hours without AI-assisted tools.
The instructions told candidates not to modify server.js, describing the component as bug-free. Kaspersky found that this file imported a trojanized npm package, colorized_terminal version 2.1.0, bundled in the archive’s node_modules directory rather than published to the npm registry. On import, the package launched a detached NodeRabbit process from a hidden cache path.
NodeRabbit communicates with Azure-hosted command-and-control servers through endpoints for registration, task polling and result submission. Its 11 commands can collect host information, list processes, execute shell commands, enumerate directories and network settings, read and write files, and alter its beacon interval. It can also write a Base64-encoded Node.js script to a randomly named temporary file, run it and delete the file.
Persistence across Windows, Linux and macOS
NodeRabbit variants use a Windows Run registry key, cron entry or macOS launch agent for persistence. Some masquerade as Microsoft Edge updates or Intel Driver & Support Assistant. A third variant accounts for Windows Subsystem for Linux and can create a daily scheduled task that invokes Visual Basic Script through wscript.exe and wsl.exe.
That variant also adds commands for drive discovery, process management, command-and-control replacement, Outlook artifact harvesting, Git repository searches and Git-hook persistence. Kaspersky said it attempts to install a fake VS Code extension named GitHub Copilot Helper, alongside additional Windows persistence mechanisms.
PollCat uses timed assessments and fake OTP validation
PollCat was delivered in another programming challenge archive, RankChallenge-react-6uJSX3-main.zip. A PDF tutorial instructed targets to enter an attacker-supplied six-digit one-time password and complete the assessment during a one-hour session. Kaspersky said the compressed activation period was likely intended to create urgency and prompt the target to run the project.
The RAT operates independently of the OTP validation result. A successful validation issues a JWT and starts an additional PollCat instance, while a failed attempt blocks challenge features but does not stop the malware. PollCat creates a daily scheduled task across Windows, Linux or macOS, reports host details to its command-and-control infrastructure and waits for instructions.
PollCat supports 22 commands for shell execution, file transfers, JavaScript execution, DLL loading, archive handling and discovery of processes, drives, volumes and mount points. It also looks for folders associated with 24 software and security vendors, including Google, Microsoft, VMware, Fortinet, CrowdStrike and SentinelOne, and transmits the root folder inventory as JSON.
Kaspersky linked PollCat to Nimbus Manticore through similarities with the group’s MiniFast backdoor, including structure, command retrieval, beacon timing and command sets, as well as the use of Azure Websites and Cloudflare-backed domains. For businesses, coding assessments should be handled as untrusted software: teams should inspect bundled dependencies and server-side code, and run externally supplied projects only in isolated environments.