What Happened
The Iranian Nimbus Manticore hacking group has been attributed to two previously undocumented malware families that highlight the continued evolution of its toolset and likely expand its targeting footprint to infect Linux and Apple macOS systems using cross-platform remote access trojans (RATs) developed using Node.js and JavaScript. Russian cybersecurity company Kaspersky is tracking the
Why It Matters
The report says Iranian Nimbus Manticore used previously undocumented malware families and cross-platform RATs built with Node.js and JavaScript to target Linux and Apple macOS systems through recruiter-themed coding tests. This is a security report about malware delivery and social engineering; it does not describe an AI system or an AI-specific attack. RealGround implication: if this pattern is used to target employees or contractors, the main defensive need is broader adversary simulation, phishing-resistant hiring workflows, and red-team testing for socially engineered payload delivery.
RealGround Analysis
This signal maps to malicious AI use. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/09/iranian-hackers-pose-as-recruiters-to.html