An Iran-linked hacking group is spreading two new cross-platform remote access trojans through fake coding tests that explicitly forbid candidates from using AI assistants, a rule Kaspersky says is designed to keep the malware from being flagged.
The group, tracked as Nimbus Manticore and also known as Mirage Kitten, poses as a recruiter on LinkedIn and other job platforms, sending engineers a ZIP archive containing a project management tool called Taskflow with instructions to fix bugs within three hours. Inside the challenge’s server.js sits an import of a trojanized npm package called colorized_terminal, tucked into the archive’s node_modules folder instead of being published to the registry. When run, it silently launches the Node.js implant NodeRabbit as a detached background process.
The no-AI instruction matters because an automated code review would likely flag that suspicious first-line import and warn the developer, Kaspersky notes. The README presents the ban as an ordinary anti-cheating rule for the timed assessment.
NodeRabbit and a second family called PollCat reach Azure-hosted command servers, and later variants add sandbox detection, corporate proxy support, and a fake GitHub Copilot Helper extension that plants a malicious launcher in Git hooks. Persistence uses a Windows Run key, a Linux cron entry, or a macOS launch agent, with samples found in Afghanistan, Egypt, and Ethiopia. The campaign marks the group’s move from C, C++, and Go tooling toward JavaScript code that runs on Windows, Linux, and macOS alike.
