# Iranian Hackers Are Handing Developers a Coding Test — and a RAT
The job interview starts innocuously enough. A recruiter reaches out on LinkedIn or via email. The role sounds right. The compensation is competitive. They want to see you code. You download the test, run it, and somewhere in the dependencies, a piece of software just handed an Iranian intelligence-linked threat actor a persistent foothold on your machine.
That is the operational reality behind what Kaspersky has now attributed to Nimbus Manticore, an Iranian hacking group that has been deploying two previously undocumented malware families through fake recruiting pipelines. What makes this campaign worth paying close attention to: the new tooling is built in Node.js and JavaScript, which means it runs on Linux and macOS just as easily as Windows. That is not an accident, and it is not a minor technical detail.
## The Coding Test as Attack Surface
The fake recruiter gambit has become one of the more reliable social engineering vectors in the APT playbook over the past few years. North Korea's Lazarus Group pioneered this approach at scale under campaigns researchers call "Contagious Interview" and "Operation Dream Job" — the latter targeting aerospace and defense engineers with fabricated Boeing and Lockheed Martin job postings. The Iranian adoption of this same template signals something important: when a technique works, it proliferates across threat actor ecosystems regardless of national affiliation.
The genius — if you want to call it that — of the coding test delivery mechanism is that it exploits context. Developers *expect* to download unfamiliar code and run it. That's the test. Their guard is specifically calibrated to be lower in this moment. They're not clicking a phishing link; they're doing their job. The social pressure of a competitive hiring process does the rest of the heavy lifting that might otherwise require technical exploitation.
Nimbus Manticore's version delivers the payload through what appears to be a legitimate development task. The malicious code sits somewhere in the project — possibly a dependency, possibly within the test itself — and executes when the candidate does what any developer would: runs the code.
## Why Node.js Changes the Target Profile
Previous reporting on Nimbus Manticore has focused on Windows-centric tooling. The pivot to Node.js-based remote access trojans is a significant expansion, and understanding why requires thinking about who the targets are rather than just what the malware does.
JavaScript runtime malware carries a particular advantage in developer environments specifically: Node.js is already installed. There's no second-stage download of an unusual interpreter, no PowerShell behavior to flag, no .exe dropped to disk. The malicious code runs in an environment the machine already trusts, using a tool the target uses every day.
Cross-platform capability also dramatically widens the attack surface. macOS has become near-ubiquitous among software engineers at technology companies, financial institutions, and security firms — organizations that have moved aggressively away from Windows laptops. Linux dominates server infrastructure and is common among backend engineers and DevOps teams. A threat actor limited to Windows-based implants simply cannot touch large portions of these high-value targets. Node.js RATs can.
The two undocumented malware families Kaspersky has identified suggest this isn't a one-off experiment. Developing and maintaining separate tooling takes resources and intent. Nimbus Manticore is building infrastructure, not running a quick campaign.
## Who Sits in the Crosshairs
The recruiting lure, the developer-facing payload, the cross-platform targeting — these choices together describe a deliberate targeting preference for software engineers, particularly those working in industries Iran has persistent strategic interest in: defense contractors, aerospace, critical infrastructure technology, financial services, and regional governments in countries Iran considers adversarial.
That last category includes Israel extensively, but also extends to Western tech companies, US defense subcontractors, and increasingly, companies with significant exposure to the Gulf states. Iranian APT activity has accelerated across the board since 2022, tracking alongside regional tensions and the group's growing operational sophistication.
Worth flagging for security teams: the developers most likely to fall for this vector are often the ones with the broadest access. Senior engineers have keys to production environments, source code repositories, internal tooling. A RAT on a senior developer's machine is frequently worth more than a RAT on a corporate workstation, because it provides access that credential theft alone cannot.
## What the Defenders Actually Need to Do
The honest answer is that endpoint detection is playing catch-up. Novel, undocumented malware families exist precisely because they haven't yet been fingerprinted. The behavioral tells matter more here than signature matching.
What defenders should be doing:
The social engineering layer is genuinely hard to patch. People need jobs. Developers get recruited constantly. Telling them to be suspicious of coding tests is not going to stick without structural changes to how organizations handle recruiting artifacts.
---
## HackWire Analysis
The Nimbus Manticore campaign arrives at a moment when the developer attack surface is under pressure from multiple directions simultaneously. Over the past 18 months, supply chain attacks against npm and PyPI have demonstrated just how effectively malicious code can be hidden inside packages developers install without scrutiny. The fake coding test is a logical extension of that same insight: get a developer to willingly run your code under circumstances where running unfamiliar code is expected behavior.
What other coverage is missing here is the competitive intelligence angle. Iranian APT groups don't just steal data — they steal intellectual property, source code, and development roadmaps that feed domestic technology programs. A RAT on a developer's machine at a Western defense contractor or semiconductor company provides the kind of persistent, deniable access that's considerably more valuable than a one-time data exfiltration. The Node.js tooling choice is not just about technical convenience; it's about targeting an engineering class that has historically been underprotected precisely because security teams have focused on corporate endpoints and perimeter defenses rather than developer workstations.
The pattern here also points toward a convergence: North Korean and Iranian APT groups are independently arriving at the same social engineering template. That convergence matters because it tells defenders that job-lure attacks are not a niche tactic — they are becoming a baseline expectation for state-sponsored targeting of technology workers. Organizations that haven't built explicit policies around how developers handle recruiting artifacts are, at this point, operating behind the threat curve.
Security teams should treat the coding test vector the same way mature organizations now treat phishing: as a persistent, ongoing threat that requires both technical controls and repeated human education. Neither alone is sufficient.
— HackWire Editorial
---
## Related Coverage