crates.io (Product): news timeline & CVEs

North Korea’s job interview scam runs both ways

North Korea's Contagious Interview group targets Rust developers with fake job scams to steal credentials and crypto, infecting 30,000+ devices.

North Korean state-sponsored threat group Contagious Interview (aka WaterPlum) is targeting Rust developers and maintainers with fake job or collaboration offers. Attackers use malicious coding assignments or video calls to trick victims into installing malware or revealing credentials. Stolen credentials are used for cryptocurrency theft, extortion, and to support North Korean IT worker schemes. International authorities report the group has infected over 30,000 devices across more than 100 countries and stolen funds from over 7,000 cryptocurrency wallets.

Help Net SecuritySep 21, 12:27 UTC · 5d agoThreat actor in the wild 3 sources

Rustaceans warned of job interviews with a malicious payload

Rust project warns attackers use fake recruiter interviews targeting crate owners to deploy RATs and compromise the package ecosystem.

The Rust project warned that attackers are targeting contributors and crate owners with fake job interviews backed by plausible company profiles and LinkedIn presences, aiming to compromise devices and accounts and potentially distribute malware through the crates.io ecosystem. Targets are urged to install purportedly missing audio codecs or execute clipboard-planted commands, delivering a remote access trojan. Security engineer Adam Harvey said the tactics resemble North Korean fake-recruiter campaigns; a recent four-nation advisory attributed compromises of more than 30,000 devices and over $10 million stolen to such DPRK operations. The warning follows a June fake-interview attempt on a crates.io maintainer and an August supply chain attack via malicious arrayref crate versions.

The Register · Securityupdated Sep 21, 12:27 UTC · 5d agofirst Sep 21, 10:33 UTC · 5d agoThreat actor in the wild 3 sources1

Be alert: targeted attacks on prominent Rustaceans

crates.io security team warns of an ongoing social engineering campaign targeting Rust crate maintainers via fake video calls to steal accounts and publish malware.

The crates.io security team and Adam Harvey warn of an active campaign targeting rust-lang members and owners of popular crates. Attackers lure targets with video calls offering jobs, projects, or contracts, then trick them into installing a purportedly missing audio codec or executing a command placed on the clipboard. The goal is to compromise devices and maintainer accounts in order to publish malware to the crates.io ecosystem.

Simon WillisonSep 17, 23:59 UTC · 9d agoPhishing & fraud in the wild

Be alert: targeted attacks on prominent Rustaceans

Ongoing social engineering campaign targets Rust maintainers via fake recruiters and video calls to compromise accounts and publish malicious crates.

The Rust project warns of an ongoing targeted campaign against rust-lang members and owners of popular crates, aiming to compromise devices and accounts to publish malware through the ecosystem. Attackers schedule video calls under positive pretexts such as jobs or contracts, using newly created but plausible-looking company profiles and LinkedIn presences to appear legitimate. Victims are persuaded to install purportedly missing audio codecs or execute commands, for example via a command placed on the clipboard. The Rust team urges verifying calls on trusted platforms, enabling MFA, checking for unexpected logins, and reporting concerns to help@crates.io or security@rust-lang.org.

Lobsters · securitySep 17, 18:10 UTC · 9d agoThreat actor in the wild1

crates.io

Timeline4 articles

Appears with

North Korea’s job interview scam runs both ways

Rustaceans warned of job interviews with a malicious payload

Be alert: targeted attacks on prominent Rustaceans

Be alert: targeted attacks on prominent Rustaceans