Rust developers are being targeted by a new and sophisticated cyberattack, with malicious actors approaching them via video calls with the aim of stealing credentials and breaching popular crates in the ecosystem. The Rust security team has issued an urgent warning, urging developers to be vigilant against unwanted approaches from unknown entities. The campaign is linked to previous incidents attributed to North Korean cybercriminals.
According to the information that has been published, the attackers are creating fake companies with LinkedIn pages that are convincing enough to overcome a superficial verification. Through these fake company identities, they approach prominent members of the Rust community and owners of popular crates, pretending to be interested in professional collaboration or recruitment. The ultimate goal is to lure victims into video calls , during which they are asked to execute malicious code or copy content from their clipboard .
This technique is not new to the arsenal of North Korean hackers, but its application to the Rust community is a worrying development. The fact that the attackers specifically target the owners of popular crates — libraries used by thousands of projects — suggests that the goal is to penetrate the software supply chain (supply chain attack), with potentially devastating consequences for the wider ecosystem.
See also: 5 malicious Rust Crates and AI bots steal developer secrets
Rust developers: The history of attacks and the connection to North Korea
The Rust team linked the current campaign to two previous incidents. In June, several prominent Rust developers were targeted in a similar manner, while in August, the popular crate arrayref was briefly compromised using similar methods. The team said it doesn’t know for sure whether all of these incidents are part of the same campaign, but the similarities are clear. The arrayref incident was reported by SecurityWeek on August 20 and was linked to North Korean cybercriminals.
In this particular attack, the malicious actors had compromised the developer’s account and published several malicious crates to the crates.io. This tactic — compromising a trusted account to distribute malware through official channels — is particularly dangerous because victims trust the original developer and don’t suspect that the library they’re using has been compromised. In the current new warning, the Rust team noted that North Korea is known to use this style of attack, which has also been observed outside of the Rust community.
North Korean cybercriminals, particularly groups like the Lazarus Group, have developed sophisticated social engineering tacticstargetingdevelopers and security researchers. Using fake corporate identities on LinkedIn and conducting video calls to deliver malware is a tactic that has been documented by organizations like Google and Microsoft in previous reports. The expansion of this tactic to the Rust community shows that attackers are actively seeking new attack vectors in the software supply chain.
See also: Malicious arrayref version infects Rust projects at compile time
Rust developers: Practical security tips
The Rust team has issued specific recommendations for Rust developers who may be targeted. First, developers are urged to be extra cautious of unsolicited approaches, especially from people or companies they don't know. Second, they are advised to conduct any calls with new contacts on platforms they trust, preferably platforms they have set up themselves. Third, they should accounts their for any suspicious activity.
Additionally, enabling multi-factor authentication (MFA) on all accounts — especially on crates.io — is absolutely essential. Rust developers should also verify that there are no unauthorized logins to their accounts and check their activity logs. If anyone suspects they have been the victim of such an attack, they should immediately change their passwords and notify the Rust security team.
See also: jscrambler npm: Malicious 8.14.0 installs Rust infostealer via npm install
For organizations using Rust in their projects, it is recommended to implement strict policies for verifying dependenciesandusing integrity checking tools for the crates they use. Regularly reviewing dependencies and monitoring for suspicious changes to popular crates can prevent supply chain before they cause damage.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
