The Rust project issued a warning about an ongoing campaign where attackers target well-known developers and maintainers of popular Rust crates.
The goal appears to go beyond stealing data from individual developers. Attackers want access to trusted developer accounts that can publish software through Rust’s package ecosystem.
The Rust crates.io team and security response working group issued the warning on Sept. 17. They said attackers are trying to compromise both devices and accounts so they can use those accounts to distribute malware.
The campaign starts with a familiar story. A target receives a message about a job, contract, or project. The attacker then arranges a video call to build trust.
During the call, the attacker may ask the victim to install a missing audio codec. In other cases, the attacker tries to get the victim to run a command placed on the computer’s clipboard.
That simple step can give an attacker access to a developer’s machine and, potentially, credentials used to publish Rust packages.
Fake companies help attackers look real
The attackers are also putting effort into making their identities look genuine. According to the Rust team, they have created new company profiles with plausible LinkedIn pages. The goal is to pass a quick check by a developer who receives an unexpected business or recruitment offer.
That tactic fits a wider pattern seen in attacks against software developers.
Kudelski Security reported in June on a North Korea-linked campaign known as “Contagious Interview.” The group posed as recruiters on platforms like LinkedIn, WhatsApp, and Discord and pushed their targets into taking fake technical interviews. Then the attackers try to trick their targets into running malicious code.
A similar campaign used fake job interviews to push a malicious VPN onto IT workers’ devices, showing how attackers can use the hiring process to deliver malware.
The research also found links to operators working from North Korea and China. However, the Rust team has not said that North Korean actors are behind the current attacks.
Instead, it says this style of attack is known to be used by the DPRK and has appeared outside the Rust community. That distinction matters. The technique may match earlier North Korean activity without proving that the same group is behind the attacks on Rust developers.
June attacks raised an earlier warning
The latest alert follows a similar wave that hit Rust developers in June. The Rust team said many prominent developers received approaches that used the same general pattern. Reporting on the incidents identified fake interview offers linked to a supposed Singapore-based venture capital firm.
Rust developer Matt Mastracci was among those targeted. According to reporting on the incident, the recruiting approach looked convincing at first but involved a company that was no longer operating. The attack nearly resulted in the installation of a remote access trojan on his machine.
Another June account described a fake interview that used a coding project to hide malicious code. The developer found the suspicious payload before allowing it to run.
These incidents show why maintainers are valuable targets. A developer with control over a widely used package may have access to much more than source code. An attacker who steals those credentials could potentially publish a malicious update under a name users already trust.
The arrayref attack showed the risk
That risk manifested in August when attackers got into the arrayref crate. On August 20, a tainted version 0.3.10 showed up on crates.io. That release snuck in a dependency on a malicious package called proc-macro1. This package came with a build script that downloaded harmful code.
The worst part is that code could run during the build process, so users didn’t have to call anything shady themselves; just building the project was enough.
The malicious arrayref release remained available for about 86 minutes before Rust removed it. According to RustSec, the malicious package got downloaded 2,285 times while it was up. Good news: versions 0.3.9 and below didn’t have this issue.
Reports also show that the attackers compromised other packages, including internment and append-only-vec. Rust locked the affected publishing account and removed the malicious releases.
The Rust team said it did not believe the legitimate arrayref developer acted maliciously. Instead, it’s likely due to a developer’s compromised computer or leaked credentials.
Rust team advises developers to remain vigilant
The Rust team hasn’t clarified whether the same attackers are responsible for the June attacks, August arrayref attacks, and the latest attacks. However, the attacks seem to share one common thing: the attackers are attempting to establish trust before accessing developer systems and accounts.
At this point, Rust is advising developers to be especially careful with any sort of unsolicited contact. They should use trustworthy platforms for calls and, whenever possible, initiate them.
Developers should be observant regarding the activities of their accounts. They should ensure that multi-factor authentication is on and be on the lookout for any unusual login activities.
This advice applies particularly to those who manage popular crates. A hacked personal account could be damaging in itself, but a hacked publication account means that the hackers could use one vulnerable developer to target the whole ecosystem. For the Rust ecosystem, that is the larger concern behind the latest attacks.
