Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows (run a Node.js project) so targets would infect their own workstations while thinking they were completing an assessment.
A threat group tracked as Nimbus Manticore approached software engineers on LinkedIn and other job platforms while posing as recruiters, including a talent acquisition specialist at a major technology company. Targets were invited to complete a technical assignment and were sent a ZIP archive, such as one named Front Technical Challenge, hosted on AWS. Inside was a realistic Node.js project for a task management tool, with instructions to fix bugs in the frontend code within a set time limit.
The twist was in the details the candidate was told to leave alone. Instructions specifically asked candidates not to modify the server component, describing it as bug free. In reality, that file contained the malicious code, including a trojanized npm package bundled directly in the archive rather than published to a public registry. When the candidate ran the project as instructed, the package silently launched a background implant that connected to attacker infrastructure and supported file access, process listing, and shell commands.
A related variant delivered a different implant through another developer assessment archive, this one including a PDF tutorial. The tutorial prompted the target to click Continue and enter a rotating six digit one time password, framed as part of a one hour assessment session.
The lure worked because it mirrored an entirely normal developer workflow: download a project, install dependencies, run the code, fix bugs. Candidates had no reason to suspect that following the stated instructions, including avoiding a specific file, was itself the trap. Bundling a malicious package inside node_modules instead of a public registry also helped it blend in with legitimate project dependencies.
Engineering and recruiting teams can reduce exposure by verifying recruiter identities and hiring steps through official company channels before any code is downloaded or run. Take-home coding challenges should be reviewed or sandboxed before execution, with particular attention to any file candidates are told not to touch. Reporting unusual recruiter behavior, unexpected OTP prompts, or compressed deadlines to IT security helps catch this pattern early, since urgency and restricted review are the core mechanisms these lures depend on.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers posed as recruiters on LinkedIn and job platforms and sent developers ZIP files framed as technical coding challenges, with malware hidden inside a Node.js project bundled in the archive.
The archive included realistic project files like a task management tool, instructions to fix frontend bugs, and a warning not to modify a specific server file, which is where the malicious code was actually embedded.
One variant included a PDF tutorial prompting the target to enter a rotating six-digit OTP and complete the challenge within a one-hour window, pushing candidates to run the project quickly without scrutiny.
Verify recruiter identities and hiring processes through official company channels, review any bundled dependencies or unexpected packages in take-home projects, and sandbox or code-review assessment archives before running them.
You get a LinkedIn message from a “talent acquisition specialist” at a big tech company: three hours to finish a coding test, ZIP file attached. You unzip Front-Technical-Challenge from AWS: a Node.js project with a Taskflow app, bundled node_modules, and instructions saying, “Find bugs in the frontend, but don’t modify server.js, it’s bug‑free.” That “bug‑free” server.js secretly imports a trojanized package that launches a remote access tool in the background. Behind the scenes, NodeRabbit and PollCat call out to Azure-hosted command servers, can read your files, list processes, run shell commands, and even stick around as a fake Edge updater, Intel driver helper, or a cron job or launch agent. One variant even pops a PDF that forces you to enter a rotating six‑digit OTP and finish in under an hour to keep you rushing. If any recruiter sends you a ZIP coding test to run locally, especially with bundled node_modules or “don’t touch server.js” rules, pause and forward it to security before you unzip or run anything.
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
An Iran-linked espionage group contacted developers and other tech specialists with fake job offers on LinkedIn and similar platforms. Victims were pushed to quickly download and run “coding challenges” that secretly installed new malware, giving attackers remote access and long-term persistence.…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
North Korea-linked Lazarus Group ran a “Dream Job” campaign targeting people applying for defense and aerospace jobs by posing as recruiters on LinkedIn and other platforms. Victims were sent malicious PDF files; opening them enabled a backdoor and then an exploit for a Windows zero-day…
