The Rust community has been alerted to an ongoing threat targeting its developers. Last week, the Rust project issued a warning about a social engineering campaign aimed at compromising the credentials of Rust-lang team members and popular crate owners. The focus of these attacks is to distribute malicious packages through hijacked developer accounts.
Details of the Social Engineering Campaign
This alert was jointly issued by the crates.io team and the security response working group. Attackers are reportedly luring developers into video calls by posing as potential employers or contractors. During these calls, targets are deceived into installing harmful software under the guise of necessary audio codecs, or they are tricked into executing malicious code copied to their clipboards.
In an effort to appear legitimate, the attackers have been setting up fictitious companies with LinkedIn profiles that can withstand cursory examination. This adds a layer of credibility to their deceptive tactics.
Connections to Previous Threats
The Rust team has linked this campaign to previous incidents. In June, several prominent Rust developers were targeted similarly, and in August, the arrayref crate was briefly compromised. Although it is unclear if these incidents are part of the same campaign, they share notable similarities.
SecurityWeek previously reported on the arrayref compromise, which was tied to North Korean threat actors. These attackers had taken control of the developer’s account and published several malicious crates.
Guidance for Developers
The Rust team has urged developers to be cautious of unexpected contacts. It is recommended that meetings with new contacts be conducted on trusted platforms, ideally ones set up by the developers themselves. Additionally, developers should regularly check their accounts for any unusual activity, ensure the activation of multi-factor authentication, and verify that all logins are recognized.
This latest advisory follows several related incidents, illustrating the ongoing risks to software supply chains. Developers are encouraged to remain vigilant and adopt robust security practices to protect their work and the broader Rust ecosystem.
