Iranian Hackers Deploy MiniFast and MiniJunk V2 via Phishing and SEO Poisoning

Why It Matters

The use of AI to accelerate malware development and the shift to SEO‑based distribution broaden the attack surface, raising the threat level for critical‑infrastructure and enterprise environments worldwide.

Key Takeaways

• Nimbus Manticore launched AI‑crafted MiniFast backdoor in March 2026
• Campaign used SEO poisoning to weaponize fake Oracle SQL Developer page
• AppDomain hijacking delivered MiniJunk V2 and MiniFast via trojanized Zoom
• Targets spanned aviation, software, oil & gas across five countries
• Threat actor’s activity accelerated after Feb 2026 regional conflict

Pulse Analysis

The emergence of MiniFast underscores a new chapter in Iranian cyber operations, where state‑backed actors are leveraging generative AI to streamline code creation. By embedding verbose error handling, repetitive naming conventions, and modular structures, the malware signals automated assistance that reduces development cycles. This trend mirrors North Korean tactics and suggests a broader shift toward AI‑enhanced espionage tools, complicating attribution and detection for security teams.

From a technical standpoint, MiniFast’s delivery chain is a hybrid of classic social engineering and novel web‑based tactics. Phishing emails masquerading as career opportunities or Zoom meeting invites drop ZIP archives that exploit AppDomain hijacking to load malicious DLLs. Simultaneously, the group registers dozens of domains to boost a counterfeit SQL Developer download page via SEO poisoning, funneling unsuspecting developers into a weaponized installer. The backdoor’s capabilities—remote command execution, file manipulation, scheduled‑task persistence, and privilege escalation via runas—provide a robust foothold for long‑term espionage.

The campaign’s breadth has tangible business implications. Targeted sectors include aviation, software development, and oil‑and‑gas, with incidents reported in the United States, Israel, the UAE, Saudi Arabia, and Australia. The exploitation of unprotected automatic tank gauge systems at U.S. gas stations illustrates a potential bridge between cyber intrusion and physical risk. Organizations must therefore harden supply‑chain software, enforce strict download verification, and monitor for anomalous HTTP beaconing. Proactive threat‑intel sharing and AI‑driven detection models are becoming essential defenses against this evolving, AI‑powered threat landscape.