[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZBn23ysMGLwajgTWDZhKMLfos24zC74hyz9f1TRlEu8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"7d176ae9-c01f-49c4-b136-8824b5e9794b","iranian-hackers-use-fake-recruiter-personas-to-deploy-cross-platform-rats-via-trojanized-coding-test","8f7a1dc7-94b7-4506-857f-9a6d489d7484","Iranian Hackers Use Fake Recruiter Personas to Deploy Cross-Platform RATs via Trojanized Coding Tests","The Nimbus Manticore group exploits the trust job seekers place in recruitment processes by embedding malicious Remote Access Trojans inside coding challenge archives that appear entirely legitimate. The attack succeeds because candidates are socially engineered to download and execute code as a normal part of a job application workflow, bypassing typical suspicion. These cross-platform RATs (NodeRabbit and PollCat) target Linux and macOS — environments often assumed to be lower-risk — expanding the attack surface beyond Windows-centric defenses. This campaign highlights how supply chain-style trust exploitation, combined with targeted spear-phishing, can circumvent technical controls when human behavior is the weakest link.","**Immediate actions:**\n- Never execute code received from unknown or unverified recruiters without first reviewing it in an isolated sandbox or virtual machine.\n- Verify recruiter identities independently through official company channels before downloading any assessment materials.\n\n**Long-term improvements:**\n- Establish a formal policy requiring employees and candidates to submit externally received code to a security review process before execution.\n- Implement application whitelisting and endpoint controls on developer machines to block unauthorized Node.js or JavaScript execution outside approved environments.\n- Conduct regular social engineering awareness training specifically covering job-platform-based phishing scenarios.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools capable of detecting anomalous Node.js process behavior, outbound C2 connections, and RAT-like activity on Linux and macOS endpoints.\n- Monitor job platform interactions and flag downloads of archive files (ZIP, TAR) originating from unsolicited recruitment messages for security review.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 10: Malware Defenses","NIST SP 800-53 AT-2: Security Awareness Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1566.002: Spearphishing Link","MITRE ATT&CK T1608.001: Upload Malware","MITRE ATT&CK T1059.007: JavaScript Execution",{},"published","2026-09-01T14:21:13.350114+00:00","2026-09-01T14:21:13.071+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Firanian-hackers-pose-as-recruiters-to.html","iranian-hackers-pose-as-recruiters-to-deliver-cross-platform-rats-through-coding-733c36","Iranian Hackers Pose as Recruiters to Deliver Cross-Platform RATs Through Coding Tests",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]