Iranian State-Aligned Hackers Target US Aviation with Phishing and SEO Poisoning (infosecurity-magazine.com)

• Nimbus Manticore targeted US aviation with phishing and SEO poisoning.
• New backdoor MiniFast disguises as Chrome, shows AI development fingerprints.
• First observed use of SEO poisoning by this group.

"IRGC-affiliated group Nimbus Manticore (UNC1549) conducted a campaign against US aviation from February to April 2026. They used career-themed phishing and, for the first time, SEO poisoning to deliver a new AI-assisted backdoor called MiniFast. The malware disguises as a Chrome browser and communicates over JSON. Check Point Research assessed the code shows hallmarks of AI-assisted development."