Be alert: targeted attacks on prominent Rustaceans
Ongoing social engineering campaign targets Rust maintainers via fake recruiters and video calls to compromise accounts and publish malicious crates.
The Rust project warns of an ongoing targeted campaign against rust-lang members and owners of popular crates, aiming to compromise devices and accounts to publish malware through the ecosystem. Attackers schedule video calls under positive pretexts such as jobs or contracts, using newly created but plausible-looking company profiles and LinkedIn presences to appear legitimate. Victims are persuaded to install purportedly missing audio codecs or execute commands, for example via a command placed on the clipboard. The Rust team urges verifying calls on trusted platforms, enabling MFA, checking for unexpected logins, and reporting concerns to help@crates.io or security@rust-lang.org.
- Campaign targets rust-lang members and owners of popular crates to compromise devices and accounts.
- Fake but legitimate-looking company profiles and LinkedIn presences pass cursory inspection.
- Lures include video calls where victims install a purportedly missing audio codec or run clipboard-planted commands.
- Goal is publishing malware through trusted maintainer accounts, creating supply-chain risk.
- Users advised to enable MFA, review logins, host calls on trusted platforms, and report to crates.io.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1078 Valid AccountsT1585.002 Social Media Accounts
- Tags
- account-compromisecrates-iofake-recruiterlinkedinrustsocial-engineeringsupply-chaintargeted-attack
- Vendors
- Rust
- Organizations
- Rust project
From the original article
1 min read at blog.rust-lang.org
We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts A video call is set up for something positive — maybe for a job, maybe for a
By blog.rust-lang.org via itamarst · blog.rust-lang.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.