The Iranian threat group Nimbus Manticore has been linked to two newly discovered malware families targeting Linux and macOS systems. The group is using a social engineering tactic where they pose as recruiters and deliver malicious coding tests to victims. The malware consists of cross-platform remote access trojans (RATs) built with Node.js and JavaScript, enabling them to infect multiple operating systems. This campaign represents an evolution of the group's toolset and an expansion of its targeting scope beyond Windows systems. Russian cybersecurity firm Kaspersky is actively tracking this threat actor and their new malware families.
The Iranian Nimbus Manticore (also tracked as Iranian Dream Job / Mirage Kitten) hacking group has deployed two new cross-platform RATs named NodeRabbit and PollCat, both written in Node.js/JavaScript. Delivery is via spear-phishing on LinkedIn and job platforms using trojanized coding challenge ZIP archives. NodeRabbit: delivered via a ZIP file ('Front-Technical-Challenge.zip') hosted on AWS containing a project management tool called Taskflow. The malicious code resides in 'server.js', which imports a trojanized npm package named 'colorized_terminal' (v2.1.0) bundled in the archive's node_modules directory (not published to npm registry). This silently launches an implant from 'node_modules/.cache/.320697f1/index.js' as a detached background process. NodeRabbit communicates with Azure-hosted C2 servers via three API endpoints (/api/rabbit/checkin, /api/rabbit/task, /api/rabbit/result) and supports 11 commands including host enumeration, process listing, shell execution, file operations, directory operations, network adapter enumeration, and beacon interval modification. It can also write and execute a Base64-encoded Node.js script to a randomly named .tmp file and delete it afterward. Three NodeRabbit variants exist: Variant 1 uses 'colorized_terminal' npm package and mimics Microsoft Edge browser update for persistence; Variant 2 uses 'pretty-log' (v2.1.0), terminates in analysis environments, partially supports corporate proxy, and mimics Intel Driver & Support Assistant for persistence; Variant 3 uses 'pretty-log' with different API endpoints (/sdk/v2/ready, /sdk/v2/config, /sdk/v2/events), adds WSL-aware persistence via a daily Windows task using VBS and wsl.exe, adds 12 new commands including harvesting Outlook OST/PST account addresses, installing a fake VS Code extension 'GitHub Copilot Helper', Git hook injection for persistence, and C2 server replacement. Persistence mechanisms: Windows Run registry key (Windows), cron entry (Linux), launch agent (macOS). PollCat: delivered via 'RankChallenge-react-6uJSX3-main.zip' with a React-based CTF-style challenge. Contains a PDF tutorial prompting the target to enter an attacker-supplied 6-digit OTP refreshed every 30 seconds, with a 1-hour session window to create urgency. PollCat runs independently of OTP validation. It supports 22 commands and 7 API endpoints (/beacon, /gate/hello, /gate/fetch, /gate/submit, /vault/<uuid>, /vault/push, /gate/track). Commands include file operations, shell execution, file upload/download, JavaScript execution, DLL loading, ZIP creation/extraction, and process/drive enumeration. PollCat inventories folders matching 24 hard-coded strings for software/security vendors and reports results to '/api/system-details/result'. Attribution to Nimbus Manticore is based on structural and behavioral similarities with the MiniFast/MiniUpdate/Retrograde backdoor and use of Azure Websites and Cloudflare-backed domains for C2.
1. Developers and engineers should be cautious of unsolicited job offers on LinkedIn and other platforms, especially those requiring execution of downloaded coding challenge archives. 2. Never run downloaded code from unknown sources without thoroughly reviewing all files, including server-side components and node_modules directories. 3. Inspect all npm packages bundled within archives rather than those from the official registry, as they may be trojanized. 4. Block or alert on connections to the identified C2 domains: plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, wslwebui.azurewebsites[.]net. 5. Monitor for suspicious persistence mechanisms: unexpected Windows Run registry keys mimicking Edge or Intel tools, new cron entries, macOS launch agents, and unusual scheduled tasks (especially those invoking wscript.exe with wsl.exe). 6. Monitor for creation of files in node_modules/.cache/ directories and execution of randomly named .tmp Node.js scripts. 7. Alert on installation of unknown VS Code extensions, particularly 'GitHub Copilot Helper' if not sanctioned. 8. Monitor Git repositories for unauthorized modifications to Git hooks. 9. Hunt for processes spawned from node_modules directories or detached background Node.js processes. 10. Review and alert on Outlook OST/PST file access by unexpected processes. 11. Educate staff about recruitment-themed social engineering lures (fake talent acquisition specialists on LinkedIn). 12. Enforce code review policies before executing any third-party or challenge-related code, and sandbox execution environments for such activities. 13. Monitor for the presence of the trojanized npm packages (colorized_terminal v2.1.0, pretty-log v2.1.0) in project dependencies.
plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, wslwebui.azurewebsites[.]net, Front-Technical-Challenge.zip, RankChallenge-react-6uJSX3-main.zip, colorized_terminal npm package (version 2.1.0), pretty-log npm package (version 2.1.0), node_modules/.cache/.320697f1/index.js, server.js (trojanized file in Taskflow project), Fake VS Code extension: GitHub Copilot Helper, API endpoints: /api/rabbit/checkin, /api/rabbit/task, /api/rabbit/result, API endpoints: /sdk/v2/ready, /sdk/v2/config, /sdk/v2/events, API endpoints: /beacon, /gate/hello, /gate/fetch, /gate/submit, /vault/<uuid>, /vault/push, /gate/track, API endpoint: /api/system-details/result, npm package: ctf-server (root package name in PollCat challenge)
