# Kaspersky links recruiter-lure campaign to new cross-platform RATs

_Published Tuesday, September 1, 2026 at 10:07 AM EDT · Security · Latest · Tier 2 — Notable_

![Kaspersky links recruiter-lure campaign to new cross-platform RATs — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhm2I0vj1ygDfFQ8UzazaxECq0aAP3UJ_VRMzeCN0MgTkWk4yLEUbKKU9dE0pIyXZIfJ0MgxjYEqAqWLAXAtuATDCdFZPI9WGkgwz04Mdd7LChIfMrWk-vhGfaHDGtySDkbIXgzBcNfh5qcobm-bz8QWuyVCcH7z9CM_RNZusA2rPEHV5g2WJ2tU6Llrdnu/s1700-nu-rw-lo-l85-e365/iran-hacking.jpg)

Kaspersky has attributed two previously undocumented JavaScript and Node.js remote-access trojans to the Iranian-linked Nimbus Manticore group. The NodeRabbit and PollCat malware families were delivered in trojanized coding-test archives sent through recruiter-themed messages on LinkedIn and job platforms, according to reporting on Kaspersky's findings. The tools can run on Windows, Linux and macOS and provide operators with command execution, file operations and persistence mechanisms. Reported sightings included systems in Afghanistan, Egypt and Ethiopia.

## Sources

- [The Hacker News](https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html)

---
Canonical: https://techandbusiness.org/newswire/bnEiXh0ZU_8BJUd90Ei2kI
Published: 2026-09-01T14:07:28.745Z
Story chronology: 2026-09-01T13:08:58.000Z
Retrieved: 2026-10-17T00:58:43.272Z
Publisher: Tech & Business (techandbusiness.org)