Kaspersky researcher Omar Amin documented a campaign by Nimbus Manticore, also tracked as Iranian Dream Job, targeting software engineers across the Middle East and Africa. Confirmed sightings are in Afghanistan, Egypt and Ethiopia.

The approach is a recruiter on LinkedIn offering a role at a major technology company, followed by a technical assignment. The assignment is a ZIP archive of real-looking project source.

The interesting part is the instruction sheet.

Two sentences do the work

The NodeRabbit archive — "Front-Technical-Challenge.zip", containing a project management tool called Taskflow — tells the candidate to debug the frontend within three hours, without AI assistance, and states that the backend server component is bug-free.

Read those as attacker instructions rather than exam rules.

"The backend is bug-free" is scoping. It tells a candidate on a 3-hour clock not to read the one directory where the malicious code lives, and it sounds like a considerate examiner narrowing the task rather than misdirection. "Without AI assistance" is the anti-analysis control: it forbids the action most likely to catch this — pasting unfamiliar code into an assistant — and reads as an ordinary hiring rule.

Plenty of real technical assessments say both of those things, which is exactly why neither raises an eyebrow.

We wrote last week about a Russian group planting a nuclear-weapon prompt in a script to derail AI analysis — a technical attempt to stop a model reading malware, with no evidence it works. This is the social version of the same goal, and it does not need to defeat a model at all. It just asks the human not to open one.

The PollCat variant uses a different pressure: a CTF-style React platform and a PDF tutorial that has the target enter attacker-supplied six-digit codes that refresh every 30 seconds. Manufactured urgency, with the attacker controlling the clock.

The dependency never touches a registry

The NodeRabbit archive ships a trojanised npm package — colorized_terminal 2.1.0 — inside node_modules, rather than declaring it so npm fetches it. Registry-side defences, package reputation, install-time scanning and lockfile review never engage, because there is no install: the code is already on disk when the candidate unzips the archive, and importing it launches the payload as a background process.

Supply-chain thinking that stops at "audit your dependencies" does not cover a dependency that was handed to you pre-installed.

What lands

NodeRabbit is a cross-platform RAT in Node.js and JavaScript running on Windows, Linux and macOS, with 11 commands in early samples and more later: host and process reconnaissance, arbitrary shell execution, file read and write, directory listing, network adapter and DNS enumeration, and beacon interval changes. Command and control runs through three Azure-hosted domains.

The advanced variant is built for developers specifically. It harvests Outlook OST/PST credentials, installs a fake VS Code extension called "GitHub Copilot Helper", injects git hooks for persistence, and supports WSL with daily scheduled tasks.

Git hook persistence is the one to sit with. A hook survives in the repository, and it runs on ordinary developer actions — so the compromise follows the work rather than the machine.

PollCat carries 22 commands across seven endpoints, and does something more pointed: it searches for 24 hard-coded vendor folders — Microsoft, Google, Palo Alto Networks, Cisco, VMware, Fortinet, Citrix, Check Point, CrowdStrike, SentinelOne, Kaspersky, ESET, Sophos and others — inventories what it finds and reports it back.

That is not reconnaissance of the machine. It is reconnaissance of the defender, performed before deciding what to do next.

Persistence is per-platform and unremarkable: registry Run keys or scheduled tasks on Windows, cron on Linux, launch agents on macOS, some variants posing as Microsoft Edge or Intel driver updates.

On the attribution

Kaspersky assessed the link to Nimbus Manticore from structural similarities, command-fetching patterns, beacon timing, resemblance to previously attributed malware (MiniFast, MiniUpdate, Retrograde), and shared Azure Websites and Cloudflare-backed C2.

That is a reasonable basis and it is an assessment, not a confirmation, and no other agency has corroborated it publicly. The campaign is also consistent with the North Korean fake-applicant operation we covered last week in shape while being a different actor with a different objective — there the goal was employment, here it is access.

What to do

  • Treat every take-home assignment as untrusted code. Run it in a disposable VM with no credentials, no SSH keys and no repository access.
  • Check node_modules in anything you were sent. A dependency directory arriving inside an archive is not normal.
  • Ignore "do not use AI" on unsolicited assignments. A real employer's assessment rule does not survive contact with an unknown ZIP file; read the code however you like.
  • Read the part you were told was fine. The instruction narrowing your attention is the instruction to distrust.
  • Audit git hooks in repositories on any machine that ran an assignment, and check for VS Code extensions nobody installed deliberately.

What is not established

  • Attribution. Assessed by Kaspersky on behavioural and infrastructure overlap; not independently confirmed.
  • How many engineers were targeted or compromised. No figures are published.
  • Which companies were impersonated. Described as major technology companies, not named.
  • Whether the unimplemented PollCat commands — WS_DOWNLOAD, REQUEST_ELEVATION, PERSIST — indicate work in progress or abandoned features.
  • Whether the two malware families are operated by the same team, as distinct from sharing tooling and infrastructure.