Rustaceans warned of job interviews with a malicious payload

Rust project warns attackers use fake recruiter interviews targeting crate owners to deploy RATs and compromise the package ecosystem.

The Rust project warned that attackers are targeting contributors and crate owners with fake job interviews backed by plausible company profiles and LinkedIn presences, aiming to compromise devices and accounts and potentially distribute malware through the crates.io ecosystem. Targets are urged to install purportedly missing audio codecs or execute clipboard-planted commands, delivering a remote access trojan. Security engineer Adam Harvey said the tactics resemble North Korean fake-recruiter campaigns; a recent four-nation advisory attributed compromises of more than 30,000 devices and over $10 million stolen to such DPRK operations. The warning follows a June fake-interview attempt on a crates.io maintainer and an August supply chain attack via malicious arrayref crate versions.