Rustaceans warned of job interviews with a malicious payload
Rust project warns attackers use fake recruiter interviews targeting crate owners to deploy RATs and compromise the package ecosystem.
The Rust project warned that attackers are targeting contributors and crate owners with fake job interviews backed by plausible company profiles and LinkedIn presences, aiming to compromise devices and accounts and potentially distribute malware through the crates.io ecosystem. Targets are urged to install purportedly missing audio codecs or execute clipboard-planted commands, delivering a remote access trojan. Security engineer Adam Harvey said the tactics resemble North Korean fake-recruiter campaigns; a recent four-nation advisory attributed compromises of more than 30,000 devices and over $10 million stolen to such DPRK operations. The warning follows a June fake-interview attempt on a crates.io maintainer and an August supply chain attack via malicious arrayref crate versions.
- Rust project warns attackers target contributors and crate owners with fake job interviews.
- Fake company profiles and LinkedIn presences are used to pass cursory inspection.
- Victims are pushed to install fake codecs or run clipboard-planted commands delivering a RAT.
- Tactics resemble DPRK fake-recruiter campaigns; advisory cites 30,000+ devices compromised and $10M+ stolen.
- Follows August supply chain attack via malicious arrayref crate versions on crates.io.
Full article365 words · extracted from theregister.com · click to collapse
security
Attackers are courting crate owners with plausible company profiles and booby-trapped recruitment calls
The Rust project has warned that attackers appear to be targeting its contributors and crate owners in an attempt to compromise their devices and accounts, potentially allowing malware to be distributed through its package ecosystem.
Posting to the Rust blog, security-focused software engineer Adam Harvey said the tactics resemble those used in North Korean fake recruiter campaigns.
"A video call is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," Harvey wrote.
REG AD
"These attackers are setting up new but legitimate-seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection."
REG AD
The warning follows several attacks targeting the Rust community over the summer.
In June, Rust developers were targeted with fake interview approaches purporting to come from a Singaporean venture capital firm. Matt Mastracci, who maintains packages on Rust's crates.io registry, said the supposedly recruiting business turned out to be defunct. The initial approach nevertheless appeared convincing and almost led to his machine being infected with a remote access trojan (RAT).
The attempted deployment of a RAT resembles activity described in an international advisory issued last week by agencies in Australia, Germany, Japan, and the US. The advisory said North Korean operators had used fake job interviews to compromise more than 30,000 devices and steal over $10 million.
Separately, Rust's package ecosystem suffered a supply chain attack in August, when malicious versions of the arrayref crate were published that downloaded malware onto users' machines.
Arrayref had recorded 245 million downloads over its lifetime, although the malicious releases were available for less than two hours. The evidence suggested that a maintainer's credentials had been compromised rather than the malware being deliberately introduced by the project's developers.
Harvey urged Rustaceans to scrutinize unsolicited approaches even when the sender appears legitimate, and to conduct calls through trusted platforms. ®