Fake Jobs, Real Malware: How Iranian Hackers Target Devs via Node.js RATs

The hiring process for software engineers has long relied on technical assessments: take-home assignments, coding challenges, and repository builds designed to evaluate a candidate's practical skills. However, what has traditionally served as a standard industry filter has increasingly transformed into a potent attack vector for sophisticated state-sponsored threat actors.

Recent cyber threat intelligence reveals a notable shift in tactics from the Iranian APT group known as Nimbus Manticore. Cybersecurity researchers have identified two previously undocumented malware families operated by the group, characterized by their use of cross-platform Remote Access Trojans (RATs) written in Node.js and JavaScript. By masquerading as legitimate talent recruiters and issuing tainted technical evaluation projects, Nimbus Manticore has successfully breached developer workstations across Windows, macOS, and Linux environments.

This campaign represents more than just a routine social engineering operation; it highlights a calculated movement toward platform-agnostic malware designed specifically to subvert modern software development ecosystems.

The Engineering Lure: How the Campaign Unfolds

The operation relies heavily on psychological manipulation, exploiting the competitive job market and software engineers' willingness to showcase their skills. The initial engagement typically begins on professional networking platforms such as LinkedIn or via direct targeted email communications.

Attackers craft believable recruiter personas, often claiming to represent established technology firms or high-growth startups seeking specialized technical talent. The roles offered are lucrative, accompanied by competitive compensation packages designed to lower the target's guard.

After an initial round of preliminary communications, the fake recruiter directs the candidate to complete a mandatory technical evaluation. This assessment typically arrives in one of two formats:

1. A compressed archive containing a pre-configured project scaffold, complete with a package.json file, project documentation, and starter code.
2. A link to a remote repository hosted on platforms like GitHub or GitLab, instructing the candidate to clone the codebase, resolve specific bugs, or implement new feature sets.

Crucially, the assessment instructions require the developer to execute the project locally using package managers such as npm, yarn, or native script runners to verify their code against unit tests. The moment the developer runs npm install or executes the project's setup script, malicious post-install hooks or obfuscated JavaScript modules launch automatically in the background, quietly compromising the underlying OS without interrupting the apparent functionality of the coding challenge.

Technical Architecture: Cross-Platform Node.js RATs

The discovery of these two new malware strains underscores a deliberate technical pivot by Nimbus Manticore. Historically, many nation-state actors relied heavily on compiled Windows executables (such as C/C++ payloads or .NET binaries) or PowerShell scripts. However, modern corporate software development environments are highly heterogeneous, heavily favoring macOS and Linux distributions.

By leveraging Node.js and raw JavaScript, Nimbus Manticore solves the problem of cross-platform payload delivery with minimal engineering overhead. Node.js environments operate identically across operating systems, allowing a single malicious code path to execute seamlessly on macOS, Linux, and Windows hosts alike.

Obfuscation and Payload Delivery

The malware modules discovered in this campaign utilize layered obfuscation to evade static security analysis. The scripts are often compressed, variable names are mangled using commercial JavaScript obfuscators, and string values are encoded using base64 or custom XOR ciphers.

Upon execution, the initial payload performs host fingerprinting to gather key environment metrics, including:

• Operating system parameters and kernel architecture
• Hostname and username details
• Active network interfaces and local IP configurations
• Running process lists, focusing on local security tools and developer utilities
• Installed developer tooling, such as Git configurations, AWS CLI keys, and SSH configurations

Command-and-Control (C2) Capabilities

Once initial host identification is complete, the malware establishes persistent outbound connections to command-and-control servers managed by Nimbus Manticore. The communication protocols often wrap traffic in standard HTTP/HTTPS headers or WebSockets to blend seamlessly into normal developer network traffic, such as telemetry originating from API calls or package downloads.

The capabilities embedded within these cross-platform Node.js RATs are comprehensive, granting the remote operators near-total control over the infected workstation:

• Arbitrary Command Execution: Running shell commands directly within the victim's terminal environment (Bash, Zsh, or PowerShell).
• File Operations: Exfiltrating sensitive local files, source code repositories, .env configuration files containing secrets, and credentials.
• Process Injection and Escalation: Fetching secondary stage payloads directly into memory or staging system-level privilege escalation exploits.
• Persistence Mechanisms: Writing malicious launch agents (on macOS), systemd services (on Linux), or registry run keys (on Windows) to survive system reboots.

Threat Actor Profile: The Evolution of Nimbus Manticore

Nimbus Manticore, an advanced persistent threat (APT) actor tied to Iranian intelligence operations, has a established history of cyber espionage, infrastructure targeting, and strategic intelligence gathering. While earlier iterations of Iranian cyber operations often focused on loud, disruptive attacks—such as website defacements or wiping operations targeting Middle Eastern infrastructure—groups like Nimbus Manticore have increasingly adopted subtle, long-term intelligence-gathering methodologies.

The shift toward target-rich software development personnel reflects a broader strategic realignment. Software engineers hold the keys to valuable enterprise intellectual property, proprietary software source code, cloud deployment environments, and CI/CD supply chain pipelines. Gaining access to an engineer's workstation provides threat actors with a pivot point into the broader corporate network, bypassing traditional boundary defenses like perimeter firewalls.

Furthermore, by weaponizing recruitment campaigns, Nimbus Manticore bypasses technical email filters. Because the malicious activity is initiated by the victim downloading, extracting, and executing code locally as part of a voluntary interaction, traditional enterprise network controls rarely flag the initial intrusion attempt.

Why Linux and macOS are Becoming Primary Targets

For years, enterprise cybersecurity defenses heavily prioritized Windows security monitoring, operating under the assumption that macOS and Linux environments were either inherently more secure or less frequently targeted by state-sponsored actors. In modern engineering organizations, however, this paradigm no longer holds true.

The vast majority of cloud-native development, DevOps engineering, and data science workflows rely entirely on Linux server environments and macOS laptops. Recognizing this shift, threat groups have invested heavily in cross-platform tooling.

Several factors make developer workstations running non-Windows systems particularly vulnerable in social engineering scenarios:

1. Over-Privileged Execution: Software development routinely requires elevated system access. Developers frequently run scripts with sudo permissions or install system-wide dependencies without second thought.
2. Security Tool Blind Spots: Endpoint Detection and Response (EDR) agents deployed on Linux and macOS endpoints historically offer less granular behavioral coverage than their Windows counterparts, particularly regarding script-based execution inside runtimes like Node.js or Python.
3. Normalized Execution of Untrusted Code: The day-to-day workflow of a developer inherently involves pulling third-party packages, cloning unverified repositories, and building complex dependency trees. Disentangling routine developer operations from malicious execution poses a major challenge for security teams.

Countermeasures and Mitigation Strategies

Mitigating the threat posed by fake recruiter campaigns and weaponized code assessments requires a combination of process-level policies, technical safeguards, and developer awareness training.

Process-Level Protections for Job Seekers

Individual developers and job seekers should adopt strict operational security protocols when engaging with prospective employers:

• Verify Recruiter Identity: Always validate recruiter outreach through official corporate channels. Check whether the communication originates from official domain email addresses rather than generic or newly registered domains.
• Insist on Isolated Evaluation Environments: Refuse to execute take-home assignments directly on primary hardware or work-provided laptops. Perform code assessments within disposable virtual machines, isolated containerized environments (such as Docker), or browser-based cloud IDEs (like GitHub Codespaces or Replit).
• Inspect Setup Scripts: Before running npm install or executing shell scripts within unfamiliar repositories, inspect package configuration files (package.json, Makefile, setup.py) for suspicious pre- or post-installation lifecycle hooks.

Enterprise Defense Recommendations

For enterprise security operations centers (SOCs) seeking to safeguard engineering teams from supply-chain intrusions:

• Implement Script Execution Controls: Monitor and restrict Node.js and other runtime engines from spawning arbitrary system shells (e.g., /bin/sh, /bin/bash, cmd.exe) on developer endpoints.
• Enforce Strict EDR Monitoring on macOS/Linux: Ensure telemetry collection covers non-Windows platforms with equivalent rigor, focusing on persistent startup items, cron jobs, and unexpected outbound network connections initiated by runtime environments.
• Credential Protection: Secure environment variables and API keys using centralized secret management tools rather than storing unencrypted credentials in local files or system environments.

The Road Ahead

The Nimbus Manticore campaign illustrates how technical sophistication and psychological manipulation intersect in modern cyber espionage. As security tooling makes traditional exploitation paths more difficult, nation-state actors will continue to target human trust and operational routines.

By weaponizing the technical hiring process, threat actors have turned routine professional interactions into high-risk security events. Countering this threat demands that both security teams and software development communities treat unverified code execution—regardless of context—with the same caution reserved for unknown executable files.