The Iran-linked Nimbus Manticore hacking group has been linked to two previously undocumented malware families that demonstrate the continued expansion of its cyber-espionage toolkit.
The newly identified threats, NodeRabbit and PollCat, are cross-platform remote access trojans (RATs) built with Node.js and JavaScript. Their ability to operate across Windows, Linux, and macOS could give the attackers a broader reach, particularly against software developers and organizations operating mixed-platform environments.
The malware has been observed in systems located in Afghanistan, Egypt, and Ethiopia, with the attackers using fake job opportunities and coding challenges to persuade targets to download and execute malicious project files.
Fake Job Offers Used to Deliver Malware
Nimbus Manticore has a history of using recruitment-themed lures to compromise targets. The group is also known by the name Iranian Dream Job, a reference to its use of fake employment opportunities and technical assignments as an initial infection method.
In one recent case, an archive named Front-Technical-Challenge.zip was hosted on an AWS infrastructure and presented as part of a job assessment for an engineering position.
The attackers reportedly posed as talent acquisition personnel from a major technology company before approaching a software engineer through professional networking and job-search platforms.
The victim was asked to download the project and complete a series of coding tasks within a limited period. The exercise involved a project-management application called Taskflow, with instructions asking the candidate to identify and fix frontend bugs.
The challenge also explicitly discouraged the use of AI-assisted programming tools and instructed the candidate not to modify the server-side component.
That server component, however, contained the malicious code.
Trojanized npm Package Launches NodeRabbit
The malicious project included a modified npm package called colorized_terminal, version 2.1.0.
Rather than publishing the package through the official npm registry, the attackers placed it directly inside the archive’s node_modules directory.
When the application imported the package, it silently launched an implant stored inside the project’s cache directory. That implant was the NodeRabbit RAT.
NodeRabbit establishes communication with attacker-controlled command-and-control (C2) infrastructure hosted on Microsoft Azure.
The malware uses several API endpoints to register infected systems, retrieve commands, and return the results to the attackers.
NodeRabbit Capabilities
NodeRabbit provides attackers with extensive remote-control capabilities.
Among its supported functions are:
- Collecting information about the infected computer.
- Listing running processes.
- Executing arbitrary shell commands.
- Enumerating directories.
- Reading files and transmitting their contents in chunks.
- Encoding and decoding Base64 data.
- Creating directories.
- Deleting files and directories.
- Collecting network adapter, MAC address, IP address, and DNS information.
- Changing the malware’s communication interval.
- Executing temporary Node.js scripts.
One particularly notable feature allows NodeRabbit to write an encoded Node.js script to a randomly generated .tmp file, execute it, and subsequently delete the file. This can help reduce obvious traces of the activity on the compromised machine.
Multiple NodeRabbit Variants Discovered
Researchers also identified two additional NodeRabbit variants in Egypt and Ethiopia.
One version replaces the original colorized_terminal package with another malicious npm package called pretty-log, also version 2.1.0. It includes partial support for corporate proxy environments and can terminate itself when running inside certain analysis environments.
A third variant also relies on pretty-log, but uses a different set of API endpoints for communication with its C2 infrastructure.
The malware uses operating-system-specific persistence mechanisms.
On Windows, it can create a Registry Run entry. On Linux, it can establish persistence through cron, while on macOS it can use a launch agent.
The persistence entries are designed to resemble legitimate software updates, including components associated with Microsoft Edge or Intel utilities.
Malware Adds Developer-Focused Capabilities
The latest NodeRabbit variant contains additional functionality that appears particularly relevant to developer environments.
It can interact with Windows Subsystem for Linux (WSL), create scheduled tasks, execute processes, terminate processes, change its active C2 server, and inspect development environments.
The malware can also search for Git repositories and inject a launcher into Git hooks to establish additional persistence.
Other capabilities include:
- Enumerating Windows drives and WSL-mounted drives.
- Harvesting account information from Outlook OST and PST files.
- Inspecting VS Code-related persistence locations.
- Creating a fake VS Code extension called GitHub Copilot Helper.
- Removing the malicious extension.
- Searching common development directories for Git repositories.
- Adding or removing malicious Git-hook launchers.
These capabilities suggest that developers and engineering environments are an important part of the attackers’ targeting strategy.
PollCat Uses Similar Recruitment Lures
Nimbus Manticore has also been observed distributing a second cross-platform RAT called PollCat through malicious programming challenges.
One campaign used an archive named RankChallenge-react-6uJSX3-main.zip, which was distributed as part of a time-limited developer assessment.
The project appeared to be a coding or capture-the-flag-style challenge. However, several elements of the application contained suspicious references, including package names and storage keys associated with CTF terminology.
The project also appeared to contain signs of AI-assisted or template-generated code, raising the possibility that the attackers used AI-based development tools to build portions of the fake coding platform before inserting their malicious components.
One-Time Password Used to Create Urgency
The archive included a PDF tutorial directing victims through the challenge process.
Targets were instructed to enter a six-digit one-time password (OTP), which changed every 30 seconds, and complete the assessment within approximately one hour.
The short deadline appears designed to create urgency and encourage victims to execute the project quickly rather than carefully inspecting its contents.
However, PollCat’s operation was not dependent on the OTP mechanism.
Even if authentication failed, the malware could continue operating in the background. Successful authentication simply provided access to additional challenge functionality and could trigger another PollCat instance.
PollCat Provides Extensive Remote Access
PollCat establishes persistence on Windows, Linux, and macOS systems and connects to its C2 infrastructure to transmit information about the infected host and receive commands.
The RAT supports dozens of commands covering common remote-access and data-theft operations.
Its capabilities include:
- Executing shell commands.
- Reading, writing, uploading, and downloading files.
- Running JavaScript.
- Loading DLLs.
- Creating and extracting ZIP archives.
- Enumerating processes.
- Enumerating drives, volumes, and mount points.
- Collecting information about the infected system.
- Maintaining persistence.
The malware communicates with its C2 infrastructure through multiple API endpoints used for registration, command retrieval, file transfers, and reporting.
Malware Checks for Security Software
PollCat also contains functionality designed to identify software installed on the victim’s computer.
The malware searches for directories associated with a large number of technology, security, virtualization, networking, and remote-access products.
When it discovers a matching directory, it collects information about the files located in its root directory and sends the results to the attackers.
This type of reconnaissance can help threat actors determine what security or enterprise software is installed on a compromised system and potentially adapt their subsequent activity.
Nimbus Manticore Continues Expanding Its Toolkit
The emergence of NodeRabbit and PollCat comes amid a broader expansion of Nimbus Manticore’s malware arsenal.
Other tools associated with the group include a Windows backdoor known as NightLedger, WebSocket-based tunneling tools such as BridgeHead and ArcBridge, a reverse SSH tunneling utility, and another backdoor with similarities to TWOSTROKE.
The group’s move toward JavaScript and Node.js-based malware is particularly significant because it provides a single codebase capable of operating across multiple operating systems.
That approach can be especially effective against organizations whose employees use a mixture of Windows, Linux, and macOS systems.
Developers Face Growing Cybersecurity Risks
The latest campaigns also highlight the increasing risks faced by software developers.
Instead of relying exclusively on traditional malicious attachments, attackers are disguising malware as legitimate development projects, coding tests, npm dependencies, and technical assessments.
For developers, a seemingly routine job assignment can therefore become an infection vector.
Organizations should treat unsolicited coding challenges and development projects with caution, particularly when they require running unknown JavaScript, Node.js applications, npm packages, or scripts on corporate systems.
The activity attributed to Nimbus Manticore shows how attackers are combining social engineering, developer-focused lures, cross-platform malware, and cloud-hosted command infrastructure to expand their reach.
As development environments become increasingly valuable targets, security teams will need to pay closer attention not only to traditional endpoints but also to developer tools, package dependencies, repositories, CI/CD environments, and AI-assisted coding workflows.
