Nimbus Manticore drops cross-platform RATs through fake job-interview coding tests
On September 1, 2026, Kaspersky detailed two cross-platform RATs, NodeRabbit and PollCat, delivered to developers as rigged recruitment challenges. The job-interview coding test is now an attack surface, and the trap sits in the node_modules that ships with the challenge.
September 1, 2026. Kaspersky published an analysis attributing two previously undocumented cross-platform RATs, NodeRabbit and PollCat, to the Iranian Nimbus Manticore group. Afghanistan, Egypt, Ethiopia. Those are the three countries where samples were recovered. Node.js and JavaScript. Those are the languages the implants are written in, so they can infect Windows, Linux, and macOS with the same payload. Why it matters: the job interview — and specifically its coding test — has become an intrusion vector in its own right.
The “technical challenge” that already contains the implant
The starting point is a spear-phishing message on LinkedIn and other job platforms. Someone posing as a talent-acquisition specialist at a major tech company approaches a software engineer and invites them to complete a technical assignment. The attached archive, Front-Technical-Challenge.zip, is hosted on AWS.
Inside is the source code of a project-management tool called Taskflow, with instructions to “find and fix all bugs in the frontend code” within three hours, without using AI-assisted tools. The brief is emphatic about one thing: do not touch the server component, server.js, described as “bug-free and functioning correctly.” That is precisely where the malicious code lives.
The first line of server.js imports a trojanized npm package named colorized_terminal, version 2.1.0. The package is not published to the npm registry — the attackers bundled it directly into the archive’s node_modules directory. On import it silently launches an implant from node_modules/.cache/.320697f1/index.js as a detached background process. Kaspersky’s read is unambiguous: the recruitment exercise is the Trojan horse, and the vendored dependency is the payload.
An 11-command RAT run from Azure
The implant, NodeRabbit, talks to three command-and-control (C2) servers hosted on Azure — plugplay.azurewebsites[.]net, rgbteller.azurewebsites[.]net, and wslwebui.azurewebsites[.]net — through three distinct API endpoints. /api/rabbit/checkin registers the agent and host information; /api/rabbit/task polls for commands; /api/rabbit/result returns task results.
The RAT exposes 11 commands covering the core of host espionage: gather host details, list running processes, execute arbitrary shell commands, enumerate directories, read a file in chunks and return Base64-encoded data, decode Base64 text and write it at a chosen offset, delete a file or recursively delete a directory, create directories, enumerate adapters with MAC, IP, and DNS settings, and alter the beacon interval.
One capability stands out: NodeRabbit writes a Base64-encoded Node.js script to a randomly named .tmp file, executes it, then deletes it to erase its tracks. Kaspersky identified two further variants sharing the same code lineage, recovered from Egypt and Ethiopia. The first swaps colorized_terminal for a package called pretty-log, version 2.1.0, and terminates if it finds itself in an analysis environment; the third uses the same pretty-log but different endpoints — /sdk/v2/ready, /sdk/v2/config, and /sdk/v2/events.
Persistence that impersonates legitimate updates
Persistence depends on the operating system, and here the campaign is built to stay quiet. On Windows, a Run registry key; on Linux, a cron entry; on macOS, a launch agent. The first two variants disguise this mechanism as a Microsoft Edge browser update or the Intel Driver & Support Assistant.
The third variant goes further. It does not impersonate any legitimate software, but it accounts for the Windows Subsystem for Linux (WSL) to create a daily 10 a.m. scheduled task that launches a Visual Basic script through wscript.exe and wsl.exe. It adds 12 new commands, including enumerating Windows drive letters and WSL mounts, launching and killing processes, replacing the active C2 server, harvesting account addresses from Outlook artifacts (OST and PST), and installing a fake VS Code extension named “GitHub Copilot Helper” for added persistence.
The campaign is part of a rapid expansion of the group’s arsenal. Nimbus Manticore historically relied on C, C++, and Go with DLL search-order hijacking. In recent months it has also fielded a Windows backdoor called NightLedger, two WebSocket tunnelers (BridgeHead and ArcBridge), a reverse SSH tunneling tool, and a backdoor overlapping TWOSTROKE. The group is also tracked as “Iranian Dream Job”, a nod to a fake-recruitment tactic long associated with the North Korean Lazarus group — the same idea, moved onto the Node.js ecosystem.
For a defender, the move to Node.js and JavaScript is the real news. Nimbus Manticore previously shipped C, C++, and Go implants via DLL search-order hijacking, a technique endpoint tooling was tuned to catch. A cross-platform Node.js RAT smuggled through a hiring challenge lands on macOS and Linux machines that many shops do not treat as first-class targets for endpoint protection. That asymmetry is precisely what the group is exploiting.
What changes for teams that hire
The trap exploits a reflex: a motivated candidate runs a technical challenge on their work machine, often without network isolation, using their real credentials. The code under review is supplied by the attacker, and the danger does not come from an obvious bug but from a dependency bundled into the shipped node_modules. A plain npm install or npm start is enough to launch the implant, without the candidate ever reading server.js.
The defense starts with a principle: treat any unsolicited recruitment challenge as untrusted code. Run it in a throwaway virtual machine or container, without network access, and audit the vendored dependencies before anything executes.
# Audit a recruitment challenge before running it
# 1. Find packages present in node_modules but absent from the public registry
for p in node_modules/*/package.json; do
name=$(grep -m1 '"name"' "$p" | cut -d'"' -f4)
code=$(curl -s -o /dev/null -w "%{http_code}" "https://registry.npmjs.org/$name")
echo "$code $name"
done
# 2. Look for detached executions typical of an implant
grep -R "spawn\|detached\|\.cache" server.js node_modules/.cache 2>/dev/nullThe second reflex for a hiring manager is to verify the recruiter’s identity out of band — a call to an official company number removes half the risk. The third is to standardize the technical hiring process so no candidate ever receives an executable archive from an unverified sender.
Signals of compromise to look for
A campaign like this leaves precise traces, and that is where a defender can act before reading a full report. The first signal is the presence, in a code repository or a challenge archive, of an npm package present in node_modules but absent from the public registry. That is exactly the signature of colorized_terminal and pretty-log, version 2.1.0, bundled by the attackers rather than published.
The second signal is network-side: the implants reach out to domains hosted on azurewebsites.net, a legitimate suffix that drowns the traffic in the noise of legitimate Azure services. The API paths, however, are distinctive: /api/rabbit/checkin, /api/rabbit/task, and /api/rabbit/result for NodeRabbit, and /sdk/v2/ready, /sdk/v2/config, and /sdk/v2/events for the third variant. Blocking or alerting on those paths, or on the three domains cited by Kaspersky, cuts the command-and-control chain.
The third signal is persistence: a Run key that mimics a Microsoft Edge update, a Linux cron entry disguised as Intel Driver & Support Assistant, or a WSL scheduled task that launches wscript.exe and wsl.exe on a fixed schedule. These are unusual patterns on a developer workstation, and they deserve review rather than an automatic pass as noise.
Verdict
If you hire developers, standardize the delivery of technical tests through a controlled platform, never as an email attachment, and require execution in a disposable environment. A challenge received on LinkedIn from a stranger should be treated as a malware sample until proven otherwise.
If you are a developer looking for work, never run a technical challenge on your work machine with your accounts signed in. A network-isolated VM, or a disposable container, is enough for the exercise — and a glance at the supplied node_modules before any npm install protects you from the colorized_terminal scenario.
If you defend a fleet, add unpublished npm packages in code repositories to your detections, and watch for beacons to Azure domains in the azurewebsites.net style used as C2. It is a weak signal, but a highly discriminating one in a campaign like this.