Defence & Security1 Sep 2026 · about 6 min

Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests

The brief

The excerpt does not explain the exact recruitment or coding-test disguise. It says Nimbus Manticore was linked to two previously undocumented malware families, potentially extending its reach to Linux and macOS through Node.js and JavaScript RATs. In a recruitment-themed operation, attackers may present a fake job assignment, interview exercise, or coding repository. The target might be urged to download files, run a project, or install dependencies. Those actions can launch malware while appearing relevant to the job. This is general cybersecurity context, not a detail confirmed by the supplied excerpt. The disguise matters because a professional-looking hiring request may seem safer than an unsolicited executable. It can reduce suspicion and encourage the target to grant access voluntarily. However, the provided text does not identify Nimbus Manticore’s exact lure, delivery steps, victims, or success rate. Those details require the missing article text or a cited investigation.

What did the Nimbus Manticore hackers do to disguise malware as a legitimate recruitment or coding-test process?

In a recruitment-themed operation, attackers may present a fake job assignment, interview exercise, or coding repository. The target might be urged to download files, run a project, or install dependencies. Those actions can launch malware while appearing relevant to the job. This is general cybersecurity context, not a detail confirmed by the supplied excerpt.

The disguise matters because a professional-looking hiring request may seem safer than an unsolicited executable. It can reduce suspicion and encourage the target to grant access voluntarily. However, the provided text does not identify Nimbus Manticore’s exact lure, delivery steps, victims, or success rate. Those details require the missing article text or a cited investigation.

What is a remote access trojan (RAT), and what can it let an attacker do on an infected computer?

A remote access trojan, or RAT, is malware that secretly gives an attacker control over a compromised computer. It combines remote-access capability with Trojan-style deception, meaning it often arrives disguised as something useful or trustworthy. The supplied excerpt identifies Nimbus Manticore’s newly attributed malware as cross-platform RATs.

Once installed, a RAT may let an attacker execute commands, download or delete files, collect credentials, inspect the system, or install additional tools. Depending on its permissions, it may also capture keystrokes, take screenshots, use the microphone, or move toward other systems. These capabilities are established RAT behavior, not all specifically confirmed in the excerpt.

The danger is that a RAT can turn one user’s device into a foothold inside a larger environment. Node.js and JavaScript development may help these tools operate across more than one operating system. The article specifically highlights possible infections of Linux and Apple macOS systems, showing why platform coverage matters.

Which operating systems can these newly attributed malware families target?

The article identifies Linux and Apple macOS as the important target systems for these newly attributed malware families. It presents that capability as a likely expansion of Nimbus Manticore’s targeting footprint. The excerpt does not say that these families target every operating system, so Windows should not be added as an article-supported conclusion.

The key point is platform reach. Linux powers many servers, developer systems, and technical environments, while macOS is common on personal and professional computers. Malware that works on both can reach different kinds of victims without requiring an entirely unrelated tool for each platform. The article attributes this reach to cross-platform RATs developed with Node.js and JavaScript.

That does not mean infection is automatic on either system. The malware still needs a delivery method, suitable runtime support, and enough permissions to perform useful actions. Even so, supporting Linux and macOS gives Nimbus Manticore more opportunities and signals continued evolution in its toolset.

Why is developing the malware with Node.js and JavaScript significant for infecting Linux and macOS systems?

Node.js provides a runtime for executing JavaScript outside a web browser. Because Node.js is available on multiple operating systems, developers can reuse much of the same application logic across Linux and macOS. That makes it practical to build one cross-platform RAT family rather than separate tools from scratch for every platform.

For example, JavaScript can handle networking, file operations, and command processing through Node.js modules. The RAT can communicate with an attacker’s server and receive instructions using this shared code. Platform-specific functions may still require different modules, paths, permissions, or installation steps. Cross-platform development therefore improves reach, but it does not remove technical differences.

The article treats this design as significant because Nimbus Manticore may be expanding beyond its earlier footprint. Linux and macOS support can expose new servers, developer devices, and workstations. Defenders must watch not only for traditional binaries, but also suspicious scripts, packages, and unexpected Node.js activity.

What could happen to a person or organization that runs one of these malicious coding tests?

Running a malicious coding test can compromise the person’s computer. The test may contain a harmful script, package, executable, or project setup step. If the user launches it, the hidden RAT could establish communication with the attacker and begin operating in the background. The supplied excerpt does not list specific victims or confirmed consequences.

A RAT may allow command execution, file theft, credential collection, system discovery, or additional malware installation. If the user has broad permissions, the damage can be greater. On an organization’s device, stolen credentials or network information could help attackers reach shared systems, repositories, cloud services, or other employees. These are general RAT risks, not individually confirmed outcomes in the excerpt.

The article’s main warning is broader targeting. Nimbus Manticore is associated with Node.js and JavaScript RATs that may infect Linux and macOS. A malicious test could therefore affect developers and technical staff using those platforms. Treating unexpected code exercises as untrusted software is an important defensive step.

Why might attackers impersonate recruiters instead of using a more direct method of delivering malware?

Attackers may impersonate recruiters because people expect hiring processes to involve messages, documents, repositories, and technical exercises. A request framed as a job opportunity can appear routine and personally relevant. That social context may make a target less suspicious than an unexpected attachment or obvious malware download. The supplied excerpt does not state why Nimbus Manticore specifically chose this tactic.

A fake recruiter could direct a candidate to a coding test, project archive, or dependency package. The target may run it willingly, giving the malware an opportunity to execute with the user’s permissions. A RAT could then contact its operator, collect system information, and support further actions. These are established social-engineering and RAT mechanisms, not campaign details confirmed by the excerpt.

This approach can also reach developers, who may have valuable credentials, source code, or access to technical infrastructure. Nimbus Manticore’s Node.js and JavaScript tools could make such lures useful across Linux and macOS environments. Trust becomes the delivery advantage, while cross-platform capability broadens the possible audience.

How do operating systems, programming runtimes, and application permissions determine whether the same malware can work across different platforms?

An operating system controls core services, file paths, processes, networking, and security rules. A programming runtime, such as Node.js, provides common functions that let JavaScript execute on different systems. This shared layer can make networking and application logic portable. However, the operating system still decides whether requested actions are available.

For example, a RAT may use Node.js to parse commands and contact its control server on both Linux and macOS. To read protected files, launch persistence, access devices, or change settings, it may need different APIs, file locations, or installation methods on each platform. Application permissions also matter. A process normally cannot access resources that the user or operating system denies.

This explains why the article highlights cross-platform RATs rather than claiming universal compatibility. Node.js and JavaScript can broaden the common codebase and target range, but effective infection still depends on delivery, runtime presence, system differences, and granted permissions. Defenders can therefore examine both malicious code and unusual runtime behavior.

This brief was written by AI from the original reporting and checked by other models. Names, figures and quotes come from the source; read it for full context.