An Iranian hacking group known as Nimbus Manticore has deployed two previously unknown malware families that can infect Linux and Apple macOS systems alongside Windows machines, according to a report published by Russian cybersecurity firm Kaspersky. The malware strains, tracked as NodeRabbit and PollCat, represent the group's shift toward cross-platform remote access trojans built with Node.js and JavaScript. Kaspersky researchers discovered the tools after identifying NodeRabbit on a system in Afghanistan, with additional infections later found on separate machines in Egypt and Ethiopia.

The threat actors deliver both malware families through fake recruitment campaigns on LinkedIn and similar job platforms, disguising the malicious code inside trojanized coding challenge archives sent to software engineers. In the Afghanistan case, attackers posed as a talent acquisition specialist from a major technology company and sent a ZIP file hosted on AWS containing source code for a project management tool called Taskflow. Candidates were instructed to find and fix bugs in the frontend code within three hours without using AI tools, while being told not to modify the "bug-free" server component where the malicious code was actually hidden. The server file imported a trojanized npm package named colorized_terminal that silently launched NodeRabbit as a background process, which then communicated with Azure-hosted command-and-control servers through three distinct API endpoints. NodeRabbit supports 11 commands that let attackers gather host details, list processes, execute shell commands, read and write files using Base64 encoding, delete files or directories, enumerate network adapters and IP addresses, and alter check-in intervals.

Kaspersky identified two additional NodeRabbit variants recovered from Egypt and Ethiopia, with the second using a different trojanized package called pretty-log and adding corporate proxy support plus anti-analysis checks that terminate execution in sandbox environments. The third variant employs the same pretty-log package but uses different API endpoints and features 12 new commands, including the ability to harvest email addresses from Outlook files, install a fake Visual Studio Code extension called "GitHub Copilot Helper" for persistence, and inject malicious launchers into Git repository hooks. According to Kaspersky security researcher Omar Amin, the operators deliver NodeRabbit "through spear-phishing messages on LinkedIn and other job search platforms that contain trojanized coding challenge archives." PollCat, the second malware strain, arrives through similar programming challenge lures distributed via time-limited developer assessments, with one archive prompting targets to enter an attacker-supplied six-digit one-time password refreshed every 30 seconds and complete the challenge within a one-hour session. The compressed timeline creates a false sense of urgency to make victims run the project quickly, though PollCat runs independently of whether OTP validation succeeds or fails.

The report notes that Nimbus Manticore has historically used malware written in C, C++, and Go with DLL search-order hijacking techniques, making the shift to cross-platform scripting languages a significant tactical evolution. The group has rapidly expanded its malware arsenal in recent months to include a Windows backdoor called NightLedger, two custom WebSocket tunnelers named BridgeHead and ArcBridge, a reverse SSH tunneling tool, and a backdoor with overlaps to TWOSTROKE. Kaspersky linked the activity to Nimbus Manticore through structural similarities between PollCat and MiniFast, a backdoor previously attributed to the group, along with matching command fetching patterns, beacon timing, and the consistent use of Azure Websites and Cloudflare-backed domains for command-and-control infrastructure. PollCat supports 22 commands covering typical backdoor functions like file operations, shell execution, JavaScript execution, DLL loading, and archive creation, while also scanning for folders matching 24 hard-coded strings corresponding to major security vendors including CrowdStrike, SentinelOne, Palo Alto Networks, and Kaspersky Lab itself. "The shift to cross-platform scripting gives the operators a single codebase that runs on Windows, Linux, and macOS, with payloads that blend naturally into developer workstations," Kaspersky stated, adding that the delivery mechanism remains consistent with the group's historical use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyber espionage purposes. Organizations face a dual challenge as social engineering tactics grow more sophisticated while defensive tools struggle to keep pace with platform-agnostic threats. The recruitment lure strategy exploits the trust inherent in professional networking platforms, turning career advancement opportunities into infection vectors that traditional endpoint security may not flag as suspicious.