Iranian State Hackers Exploit Tech Job Market to Deploy Advanced Cross-Platform Malware
Iranian threat group Nimbus Manticore (also known as Mirage Kitten) has expanded their attack methodology by deploying cross-platform remote access trojans (RATs) through sophisticated social engineering campaigns targeting software engineers. The group poses as recruiters from major technology companies on LinkedIn and other job platforms, delivering trojanized coding challenges containing NodeRabbit and PollCat malware. These Node.js and JavaScript-based RATs can infect Windows, Linux, and macOS systems, representing a significant evolution from their traditional C/C++ toolset. The campaign has been observed targeting victims across Afghanistan, Egypt, and Ethiopia, demonstrating the group's expanded geographic reach and technical capabilities. This incident highlights the growing trend of state-sponsored actors adopting cross-platform development frameworks to maximize their attack surface while leveraging legitimate recruitment processes as attack vectors. The sophisticated nature of these fake coding challenges and the pressure tactics employed demonstrate how threat actors are increasingly exploiting the competitive job market in the technology sector.
Kill Chain
