Fake Recruiters Deploy NodeRabbit and PollCat: Nimbus Manticore’s New Cross-Platform RATs

A cyberespionage campaign attributed to the Iranian group Nimbus Manticore, also known as Iranian Dream Job, is targeting developers through LinkedIn and other employment platforms. The operation, disclosed on September 1, 2026, turns ordinary coding tests into delivery vehicles for two previously undocumented remote access trojans: NodeRabbit and PollCat.

Kaspersky has linked both malware families to the Iranian threat actor. Victims receive archives that appear to have been prepared by recruiters from major technology companies and are instructed to run software projects locally under extremely tight deadlines. The malicious code is hidden in application files, pre-bundled npm dependencies, or startup components.

There is no patch to install: this is not a product vulnerability, but a social engineering chain that persuades candidates to execute the malware.

The Technical Test Becomes the First Stage of the Intrusion

Nimbus Manticore uses a procedure built around activities familiar to software engineers. An alleged recruiter contacts the candidate, presents a job opportunity, and assigns a plausible technical assessment.

In the observed case in Afghanistan, the Front-Technical-Challenge.zip archive, hosted on AWS, contained the source code for a project management tool called Taskflow. The instructions gave the candidate three hours to fix frontend bugs and prohibited the use of AI-based assistants.

One instruction explicitly told the candidate not to modify server.js, which was described as already functional. In reality, it was the infection trigger.

The first line of the file imported colorized_terminal version 2.1.0, a counterfeit npm package. The dependency did not come from the npm registry; it had been placed directly in the node_modules directory included in the archive. Once imported, the package launched the following in the background:

node_modules/.cache/.320697f1/index.js

That file contains NodeRabbit. The technique avoids presenting the victim with an obviously suspicious executable and takes advantage of the normal test workflow: installing or inspecting the project, starting the server, and testing the application.

Additional samples from the same family were identified on two systems in Egypt and Ethiopia. In those variants, the decoy package was pretty-log version 2.1.0, also embedded in the project as a trojanized dependency.

NodeRabbit Controls Files, Processes, and Network Configuration

NodeRabbit is a Node.js-based RAT designed to operate on Windows, Linux, and macOS. The first analyzed variant communicates with three Azure-hosted applications:

• plugplay.azurewebsites[.]net
• rgbteller.azurewebsites[.]net
• wslwebui.azurewebsites[.]net

The command-and-control protocol separates registration, task retrieval, and result submission. The corresponding endpoints are /api/rabbit/checkin, /api/rabbit/task, and /api/rabbit/result.

The 11 supported commands allow operators to collect host information, enumerate processes, execute shell commands, and browse directories. The malware can also read files in chunks, return them as Base64, write decoded content to arbitrary locations, and delete files or entire directories.

Its reconnaissance covers network adapters, MAC and IP addresses, and DNS configuration. The server can also modify the beaconing interval, adapting C2 traffic to the needs of the operation.

One function allows the malware to receive a Base64-encoded Node.js script, save it under a random name with a .tmp extension, execute it, and immediately delete it. This enables the attacker to dynamically extend the implant’s capabilities while leaving fewer permanent files on the system.

More recent variants introduce anti-analysis checks and partial support for corporate proxies. One of them uses endpoints disguised as software services:

• /sdk/v2/ready
• /sdk/v2/config
• /sdk/v2/events

Persistence varies by operating system: a Run registry key on Windows, a cron entry on Linux, and a Launch Agent on macOS. Some samples masquerade as Microsoft Edge updates or Intel Driver & Support Assistant components.

WSL, VS Code, and Git Hooks Expand Persistence

The third NodeRabbit variant includes functionality targeting Windows Subsystem for Linux. It creates a Windows task that runs every day at 10:00, launching a Visual Basic script through wscript.exe and wsl.exe.

It also adds 12 commands dedicated to process management, persistence, and development environments. The malware can enumerate Windows drives visible from WSL, terminate processes, change the C2 server, and check which address is currently configured.

The functions aimed at developer tools are particularly significant. The RAT can search for Git repositories in common or recently used directories and then insert a launcher into Git hooks. Normal repository operations can therefore reactivate the malware.

NodeRabbit can also install a fake Visual Studio Code extension called “GitHub Copilot Helper”, manage its persistence, and remove it on command. Another capability extracts account addresses from Outlook OST and PST archives.

These features indicate that the objective is not merely to maintain access to the workstation. Repositories, credentials, professional contacts, and development tools can provide material for further intrusions.

PollCat Uses OTPs and Urgency as Stage Props

The second attack chain uses the RankChallenge-react-6uJSX3-main.zip archive, presented as a timed technical assessment. The project contains several inconsistent references to CTF exercises: the main package is named ctf-server, the backend prints CTF server running, and the frontend uses keys with the ctf- prefix.

These elements suggest that the application may have been derived from a template or generated with automated assistance. Kaspersky also considers it possible that the operators asked an AI assistant to create a CTF-style React platform and subsequently added the malware.

A PDF tutorial instructs the candidate to click Continue, enter a six-digit OTP that changes every 30 seconds, and complete the exercise within one hour. The procedure creates a sense of urgency but does not actually protect the assessment.

PollCat operates independently of the OTP. A validation error prevents access to some exercise features but does not stop the infection. If verification succeeds, the application generates a JWT and even launches a second instance of the RAT.

PollCat, written in obfuscated JavaScript, establishes daily persistence on Windows, Linux, or macOS. Its seven endpoints handle registration, host identification, command retrieval, result submission, and file transfer. They include /beacon, /gate/hello, /gate/fetch, /gate/submit, /vault/<uuid>, /vault/push, and /gate/track.

The malware has 22 commands for file operations, shell and JavaScript execution, data transfer, DLL loading, and ZIP archive management. It can also enumerate processes, drives, volumes, and mount points. Three instructions—WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST—are present but not implemented.

Reconnaissance Looks for Enterprise Software and Security Products

PollCat checks for directories associated with 24 companies and product families, including Microsoft, Google, Cisco, VMware, Fortinet, Palo Alto Networks, CrowdStrike, SentinelOne, Kaspersky Lab, ESET, and Bitdefender.

The search also covers browsers and remote access tools. When it finds a match, the RAT inventories the directory root and sends the result as JSON to /api/system-details/result.

The scan is not recursive, but it still provides operators with an initial workstation profile: installed defenses, enterprise applications, browsers, and potential administrative tools. This information can guide subsequent actions and help the attackers avoid specific security controls.

The attribution to Nimbus Manticore is also supported by similarities to MiniFast, also known as MiniUpdate or Retrograde. PollCat shares that backdoor’s beaconing and command-retrieval mechanisms, operational characteristics, and use of Azure Websites and Cloudflare-protected domains.

The campaign marks an evolution from the C, C++, and Go tools previously associated with the group. A cross-platform JavaScript codebase reduces the effort required to target different systems and blends more naturally into projects intended for developers.

How to Detect and Contain a Potential Attack

Organizations should treat any coding challenge received from a recruiter as untrusted until the recruiter’s identity and company have been verified through an independent channel. Archives containing an already-populated node_modules directory warrant particular caution.

Defenders should search for colorized_terminal 2.1.0, pretty-log 2.1.0, JavaScript files hidden under .cache, and unauthorized VS Code extensions. The presence of “GitHub Copilot Helper” should be investigated in particular.

Incident response activities should include checks for:

• Run registry keys;
• scheduled tasks and daily launches at 10:00;
• cron entries and Launch Agents;
• modified Git hooks;
• anomalous executions of node, wscript.exe, and wsl.exe;
• unexpected access to Outlook OST or PST files;
• connections to the Azure hosts associated with NodeRabbit;
• traffic to the described C2 endpoints.

Dependencies should be reinstalled from verified registries rather than using those supplied in the archive. External assessments should be run in sandboxes or isolated virtual machines, without corporate credentials, sensitive repositories, or access to production systems.

No CVSS score is known, and there is no remediation update. Defense therefore depends on scrutinizing received projects, separating development environments, and monitoring the persistence techniques used by both RATs.