# Kaspersky links recruiter-lure campaign to new cross-platform RATs

_Tuesday, September 1, 2026 at 9:08 AM EDT · Security · Latest · Tier 2 — Notable_

![Kaspersky links recruiter-lure campaign to new cross-platform RATs — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm2I0vj1ygDfFQ8UzazaxECq0aAP3UJ_VRMzeCN0MgTkWk4yLEUbKKU9dE0pIyXZIfJ0MgxjYEqAqWLAXAtuATDCdFZPI9WGkgwz04Mdd7LChIfMrWk-vhGfaHDGtySDkbIXgzBcNfh5qcobm-bz8QWuyVCcH7z9CM_RNZusA2rPEHV5g2WJ2tU6Llrdnu/s1700-nu-rw-lo-l85-e365/iran-hacking.jpg)

Kaspersky has attributed two previously undocumented JavaScript and Node.js remote-access trojans to the Iranian-linked Nimbus Manticore group. The NodeRabbit and PollCat malware families were delivered in trojanized coding-test archives sent through recruiter-themed messages on LinkedIn and job platforms, according to reporting on Kaspersky's findings. The tools can run on Windows, Linux and macOS and provide operators with command execution, file operations and persistence mechanisms. Reported sightings included systems in Afghanistan, Egypt and Ethiopia.

## Sources

- [The Hacker News](https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html)

---
Canonical: https://techandbusiness.org/newswire/bnEiXh0ZU_8BJUd90Ei2kI
Retrieved: 2026-09-01T16:49:04.617Z
Publisher: Tech & Business (techandbusiness.org)