Iranian Hackers Nimbus Manticore Target Mac and Linux With Fake Job Tests

Key points

• Kaspersky has tied Iranian hacking group Nimbus Manticore to two new pieces of malware built to run on Windows, macOS and Linux computers.
• Attackers pose as recruiters and send fake coding tests to job seekers, which quietly install spy tools when opened.
• The malware is written in Node.js and JavaScript, so a single version works across all three operating systems.
• Targets appear to include people working in aerospace, defence and telecoms.
• No ransom is involved. The goal is spying.

Iranian hacking crew Nimbus Manticore has quietly expanded its arsenal, and its list of possible victims, with two new pieces of malware that can spy on Windows, macOS and Linux machines alike.

The finding comes from Kaspersky, the Russian antivirus firm that published its analysis this week. Nimbus Manticore is a state-aligned Iranian outfit. It doesn't steal money. It steals information, usually from defence, aerospace and telecoms companies, the kind of targets Tehran's intelligence services care about. We've followed the group since May 2026, and our 26 August story on its new backdoor and SSH tunneler showed it building out fresh infrastructure at pace. These two new malware families are the next step.

How does the attack actually work?

The hackers pretend to be recruiters. They approach people on job sites and messaging apps, build rapport, then send over a coding test the candidate has to complete. Opening the file installs the malware.

Once run, it plants a remote access trojan, malicious software that lets an outside operator quietly control the computer. From there, attackers can read files, log keystrokes and pivot into the victim's employer network.

The fake-recruiter trick isn't new. North Korean crews have used it for years against cryptocurrency engineers, and Russian hackers ran the same play against Ukrainian IT staff as recently as August. What's new here is that Iran's operators are now running it too, with polished tooling built to survive on any operating system a target happens to use.

Why does the Mac and Linux angle matter?

Most commodity spyware only runs on Windows, because Windows dominates corporate desktops. By writing these tools in Node.js and JavaScript, two languages used to build websites, Nimbus Manticore gets one codebase that runs across all three major platforms with little extra work.

That matters because engineers, researchers and defence-sector staff, the people this group tends to target, disproportionately use Macs and Linux laptops. Until now, many assumed their choice of computer offered some protection from Iranian spying. It doesn't.

What we know so far

Kaspersky hasn't named specific victim companies, and no ransom demands are attached to this activity. The operation looks purely about intelligence gathering.

What should ordinary readers do?

If you're job hunting, treat unsolicited recruiter messages with the same suspicion as an unexpected email from your bank. Real recruiters almost never ask you to run a downloaded file on your own computer. A legitimate coding test lives inside a browser on a known platform like HackerRank or Codility.

A few plain rules help:

1. Verify the recruiter on the hiring company's own website before opening anything.
2. Run any test file inside a throwaway virtual machine, or ask to complete the task in the browser.
3. If a recruiter pushes urgency, stop. That's the tell.
4. Keep your operating system and antivirus updated, even on a Mac or Linux laptop.

For employers, the message is blunter. Staff on LinkedIn are now a delivery channel for state-level spyware, and the malware no longer cares what laptop they're carrying.