Be alert: targeted attacks on prominent Rustaceans
crates.io security team warns of an ongoing social engineering campaign targeting Rust crate maintainers via fake video calls to steal accounts and publish malware.
The crates.io security team and Adam Harvey warn of an active campaign targeting rust-lang members and owners of popular crates. Attackers lure targets with video calls offering jobs, projects, or contracts, then trick them into installing a purportedly missing audio codec or executing a command placed on the clipboard. The goal is to compromise devices and maintainer accounts in order to publish malware to the crates.io ecosystem.
- Ongoing campaign targets rust-lang members and popular crate owners
- Video call lures pose as job, project, or contract opportunities
- Victims prompted to install a fake missing audio codec or run clipboard commands
- Objective is compromising devices and accounts to publish malware
- Public warning issued by the crates security team
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1204 User ExecutionT1078 Valid Accounts
- Products
- crates.io
From the original article
Be alert: targeted attacks on prominent Rustaceans Important warning from Adam Harvey and the crates security team: We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.
simonwillison.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.