Be alert: targeted attacks on prominent Rustaceans
Ongoing social engineering campaign targets Rust maintainers via fake recruiters and video calls to compromise accounts and publish malicious crates.
The Rust project warns of an ongoing targeted campaign against rust-lang members and owners of popular crates, aiming to compromise devices and accounts to publish malware through the ecosystem. Attackers schedule video calls under positive pretexts such as jobs or contracts, using newly created but plausible-looking company profiles and LinkedIn presences to appear legitimate. Victims are persuaded to install purportedly missing audio codecs or execute commands, for example via a command placed on the clipboard. The Rust team urges verifying calls on trusted platforms, enabling MFA, checking for unexpected logins, and reporting concerns to help@crates.io or security@rust-lang.org.
- Campaign targets rust-lang members and owners of popular crates to compromise devices and accounts.
- Fake but legitimate-looking company profiles and LinkedIn presences pass cursory inspection.
- Lures include video calls where victims install a purportedly missing audio codec or run clipboard-planted commands.
- Goal is publishing malware through trusted maintainer accounts, creating supply-chain risk.
- Users advised to enable MFA, review logins, host calls on trusted platforms, and report to crates.io.
Full article219 words · extracted from blog.rust-lang.org · click to collapse
We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.
What we've seen
A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).
These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection.
What you can do
Please take extra care in the near term. Be appropriately suspicious of cold outreaches, and ensure that any calls you have with new people are on platforms you trust — ideally, try to be the one who sets up the call on a platform you already use.
Please also re-check that your accounts look normal: MFA enabled, no unexpected logins on platforms that can track that, and so on.
If you have any concerns about your accounts, please reach out to help@crates.io (for crates.io account concerns) and/or security@rust-lang.org (for any other concerns). We're very happy to help.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.rust-lang.org/2026/09/17/targeted-attacks/