https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html
An Iranian state-linked hacking group known as Nimbus Manticore has been caught running a recruitment scam designed to trick software engineers into infecting their own machines with newly discovered malware. According to Russian cybersecurity firm Kaspersky, the group has been impersonating talent acquisition specialists at major technology companies on LinkedIn and other job platforms, approaching engineers with what appear to be legitimate technical interview challenges. The bait comes in the form of a ZIP archive containing a project management application called Taskflow, with candidates instructed to find and fix bugs in the frontend code within three hours. The catch is buried in the server-side file they are specifically told not to touch, which contains a trojanised npm package that silently installs a remote access trojan called NodeRabbit as a background process the moment the project is opened.
NodeRabbit is one of two previously undocumented malware families attributed to the group, the other being a related tool called PollCat. Both are built using Node.js and JavaScript, marking a notable shift for Nimbus Manticore which has historically favoured malware written in C, C++ and Go. The move to cross-platform tooling means the malware is capable of targeting Windows, Linux and Apple macOS systems from a single codebase. Once installed, NodeRabbit communicates with command-and-control infrastructure hosted on Microsoft Azure and supports a broad range of capabilities including executing shell commands, harvesting system information, reading and writing files, and even pulling account data from Outlook archives. Kaspersky researchers identified three distinct variants of NodeRabbit, with infections observed across systems in Afghanistan, Egypt and Ethiopia.
The campaign bears strong similarities to tactics long associated with the North Korea-linked Lazarus Group, which has used recruitment-themed lures for years to compromise targets in the technology and defence sectors. Nimbus Manticore, also tracked under the name Iranian Dream Job, appears to have borrowed directly from that playbook while layering in its own technical sophistication. Notably, the third NodeRabbit variant goes further than its predecessors by attempting to install a fake Visual Studio Code extension disguised as a GitHub Copilot Helper tool, adding yet another persistence mechanism to an already deeply embedded implant. The findings shows a growing trend of threat actors weaponising the hiring process itself, turning the routine act of completing a coding challenge into a fully operational intrusion.