Emerging ThreatsMalware & Ransomware

Iranian Hackers Deploy Cross-Platform Malware via Coding Tests

Analyst 207||Source: TheHackerNews
Developer workstation with laptop, coding materials, and papers scattered on a desk in a bright, modern office space.

"Its operators deliver [NodeRabbit] through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives," Kaspersky security researcher Omar Amin said.

That single sentence captures the core of a campaign Kaspersky links to the Iranian threat group Nimbus Manticore: cross‑platform remote access trojans (RATs) written in Node.js and obfuscated JavaScript, delivered inside what appear to be legitimate developer hiring exercises. Kaspersky is tracking the two newly documented families as NodeRabbit and PollCat and says their presence reflects a deliberate move by the group to broaden infections beyond Windows to Linux and macOS developer workstations.

NodeRabbit: delivery mechanics and command set

  • The first NodeRabbit sample was recovered from a system in Afghanistan, with additional variants later found on machines in Egypt and Ethiopia.
  • Delivery is accomplished through trojanized coding challenge archives — an example archive named Front-Technical-Challenge.zip contained a Taskflow project and a bundled malicious npm package. The first line of server.js in that archive imported a trojanized package named colorized_terminal, version 2.1.0, which launched the implant from node_modules/.cache/.320697f1/index.js as a detached background process.
  • NodeRabbit communicates with Azure-hosted command-and-control (C2) domains: plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, and wslwebui.azurewebsites[.]net using API endpoints /api/rabbit/checkin, /api/rabbit/task, and /api/rabbit/result.
  • The malware supports 11 commands including host detail collection, process listing, arbitrary shell execution, directory enumeration, chunked file reads (Base64-encoded), Base64 decode-and-write at offsets, file and recursive directory deletion, recursive directory creation, network adapter and DNS enumeration, and beacon-interval modification. It can also write a Base64-encoded Node.js script to a randomly named .tmp file, execute it, and then delete it to erase traces.
  • Kaspersky identified two additional NodeRabbit variants: one using a trojanized pretty-log (version 2.1.0) package with anti-analysis and partial corporate proxy support, and a third variant that also uses pretty-log but different API endpoints (/sdk/v2/ready, /sdk/v2/config, /sdk/v2/events).
  • Persistence is platform-aware: a Windows Run registry key, a cron entry on Linux, and a macOS launch agent. Two variants impersonate legitimate software — one mimics a Microsoft Edge update, another Intel's Driver & Support Assistant. The third variant does not impersonate software but accounts for Windows Subsystem for Linux (WSL) by creating a daily 10 a.m. Windows scheduled task that launches a Visual Basic Script via wscript.exe and wsl.exe.
  • The third variant adds 12 new commands that include enumerating Windows drive letters or WSL-mounted drives; executing or killing processes; replacing and reporting the active C2 server; harvesting Outlook OST/PST account addresses; attempting to install a fake VS Code extension named "GitHub Copilot Helper" and adding a Run value for persistence; checking and removing marked persistence indicators; searching development locations for Git repositories; and injecting or removing a launcher in a repository's Git hooks.

PollCat: CTF-style lures, API endpoints, and vendor checks

  • PollCat has been distributed via compressed developer assessments (example: RankChallenge-react-6uJSX3-main.zip) that use CTF-style terminology in the project and a PDF tutorial that prompts targets to enter an attacker-supplied six-digit OTP refreshed every 30 seconds and to complete the challenge within a one-hour session.
  • Kaspersky notes PollCat runs independently of the OTP step: a failed OTP blocks protected features but PollCat remains active; a successful OTP issues a JWT and may start an additional PollCat instance.
  • PollCat creates a daily scheduled task for persistence on Windows, Linux, or macOS, then connects to C2 and supports 22 commands. It communicates over seven API endpoints: /beacon, /gate/hello, /gate/fetch?token=, /gate/submit, /vault/, /vault/push, and /gate/track.
  • Implemented commands enable file operations, shell execution, upload/download, JavaScript execution, DLL loading, ZIP create/extract, and enumeration of processes, drives, volumes, or mount points. Three commands (WS_DOWNLOAD, REQUEST_ELEVATION, and PERSIST) are noted as not implemented.
  • PollCat probes for folders matching 24 hard-coded vendor strings — including Google, Microsoft, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, Juniper Networks, LogMeIn, Sophos, Symantec, Trend Micro, McAfee, Kaspersky Lab, ESET, Bitdefender, Avast, CrowdStrike, SentinelOne, Malwarebytes, Brave, Tencent, and Naver — inventories any matching root contents (non-recursively), and sends the results as JSON to /api/system-details/result.

Nimbus Manticore's expanding toolkit and linkage

  • Kaspersky places NodeRabbit and PollCat within a broader expansion of Nimbus Manticore's malware arsenal: recent additions include a Windows backdoor named NightLedger, two custom WebSocket tunnelers called BridgeHead and ArcBridge, a reverse SSH tunneling tool, and a backdoor with overlaps to TWOSTROKE.
  • The shift to cross-platform scripting represents a change from the group's historical use of C, C++, Go, and DLL search-order hijacking techniques.
  • Kaspersky cites structural and behavioral similarities between PollCat and MiniFast (aka MiniUpdate or Retrograde), and notes the use of Azure Websites and Cloudflare-backed domains for C2 as linking factors.

Delivery via recruiter personas and developer-focused deception

  • Kaspersky documents the actor masquerading as a talent-acquisition specialist at a major technology company to invite targets to a technical assignment — a tradecraft Kaspersky says is consistent with the group's “Iranian Dream Job” persona and mirrors tactics used elsewhere in the past.
  • Typical lure content: a Taskflow project that instructs a candidate to "find and fix all bugs in the frontend code" within three hours and to avoid using AI assistance, while explicitly asking not to modify server.js — the very file containing the hidden trojanized package.
  • As Kaspersky puts it: "The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyber espionage purposes."

What this means for technologists, procurement leaders, and developers

  • Technologists and security teams should note the cross‑platform focus and WSL-aware persistence: developer workstations running Node.js, WSL, or macOS tooling can be targeted with a single codebase that runs across environments.
  • Procurement and IT asset owners must be conscious that persistence mechanisms impersonate legitimate update software (Microsoft Edge, Intel Driver & Support Assistant) and that attackers explicitly search for security- and vendor-related folders.
  • Developers are specifically targeted by trojanized coding challenges and time-limited assessments; the archive-based delivery and bundled npm packages (colorized_terminal and pretty-log, both version 2.1.0 in observed samples) underline the risk of running unvetted challenge code locally.

Kaspersky's findings show a deliberate pivot: cross-platform Node.js and JavaScript implants tailored to blend into developer workflows, delivered through recruiter lures and time-pressured assessments. Whether those choices will materially widen the group's victim set remains the central operational question the findings raise.

Original story

Emerging ThreatsLinkedinLinuxMacosNation-StateNode.JsSpear-PhishingWindowsIranian HackersCross-Platform MalwareNoderabbit
Related Intelligence

Continue Reading

Network equipment rack with cables and patch cords in a data center interior.

BGP Hijack Targets Softaculous Traffic, Delivers Malware

In a shocking 33-hour heist, a BGP hijack diverted traffic meant for Softaculous, delivering malware to unsuspecting users via a valid TLS certificate issued to the attacker. The clever hack exploited a weakness in internet routing, allowing the attacker to intercept and compromise Virtualizor installations.

Analyst 207
Person in office cubicle looks at laptop with confusion and curiosity.

Cyberattackers Favor Repeatable Playbooks Over Innovative Tactics

Cyberattackers are ditching creative tactics for a straightforward, repeatable playbook - and it's surprisingly effective, with a simple trick called ClickFix accounting for 47% of attacks. This sneaky method involves guiding users through a CAPTCHA-style interaction, then tricking them into pasting a command into a terminal, all without needing attachments or vulnerabilities.

Analyst 207
Refrigerated case with doors ajar, shelves stocked with food and drinks, digital display blank or out of focus.

DoD Refrigerator Outages Spark Hacking Fears

A defense official has warned of possible refrigeration disruptions at some Defense Commissary Agency commissaries, sparking concerns about the security of military food storage systems. Several bases have already reported outages, including Fort Irwin, F.E. Warren Air Force Base, and Naval Station Newport.

Analyst 207
Blurred laptop on airport security counter amidst muted colors.

Mirage Kitten Unveils Node.js Malware Targeting Aviation, FinTech

Kaspersky's threat research uncovered a sneaky Node.js malware campaign targeting aviation and FinTech organizations in the Middle East and Africa, with victims initially tricked by fake job offers on LinkedIn. The malware, known as NodeRabbit, was delivered through cleverly disguised coding-challenge archives.

Analyst 207