Threats · 12h ago
The Rust project warned that attackers are actively targeting Rust team members and popular crate owners with fake job-offer video calls, aiming to compromise developer accounts and push malicious packages. The warning connects the current activity to similar targeting in June and the arrayref crate compromise in August.
The lure is simple: a convincing company profile and interview setup, then a prompt to install software for a missing codec or paste code from the clipboard. If the maintainer runs it, the attacker can steal credentials or execute code on that account, and once the publisher account is theirs, they can ship crates that look legitimate to downstream users.
That puts the risk at the publisher trust chain, not just the endpoint. For any team that signs or publishes packages, the durable exposure is the human identity that can release software; technical controls on the build side do not stop a hijacked maintainer account from poisoning the package feed.
2 sources covering this story
Rustaceans warned of job interviews with a malicious payload
Attackers are courting crate owners with plausible company profiles and booby-trapped recruitment calls
Rust Team Members and Popular Crate Owners Targeted via Video Calls
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea.
Part of the PlainSec briefing for 2026-09-21