Kaspersky has attributed two previously undocumented malware families to the Iranian Nimbus Manticore group. The threat actors pose as recruiters on professional platforms, enticing victims with fraudulent job offers and coding test assignments. Execution of these tests delivers cross-platform RATs capable of infecting Linux and Apple macOS systems, marking an expansion of the group's targeting footprint beyond traditional Windows operations.

Which products are affected?

Linux systems, Apple macOS systems

What should defenders do?

Verify the legitimacy of recruiter contacts and job offers through official channels. Sandbox the execution of any coding test assignments or take-home tasks before running them on primary workstations. Apply standard endpoint security controls, including application whitelisting and behavior-based detection, to identify suspicious Node.js or JavaScript activity.

highMalware

Iranian Hackers Disguise Cross-Platform RATs as Coding Tests to Target Linux and macOS

Nimbus Manticore campaign uses fake recruiter personas to deliver Node.js and JavaScript-based remote access trojans

CyberIntel DeskPublished 27 days agoUpdated less than a minute ago1 min read

Iranian Hackers Disguise Cross-Platform RATs as Coding Tests to Target Linux and macOS

Key Takeaways

Nimbus Manticore attributed with two new cross-platform malware families.
Campaign uses fake recruiter personas and fraudulent coding tests as bait.
Malware targets Linux and macOS in addition to traditional Windows systems.
RATs are developed using Node.js and JavaScript for cross-platform compatibility.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read