The Rust programming language community has been warned of a targeted attack against key developers, aiming to compromise their devices and accounts to distribute malware within the Rust ecosystem. The attacks involve the creation of fake LinkedIn profiles and the use of job or contracting opportunities to trick developers into installing malicious software.
The Rust security response working group and the Crates.io team issued the warning, noting that members of the Rust-Lang team, responsible for developing the Rust programming language, and owners of popular Rust crates are being specifically targeted. The attackers are reportedly employing sophisticated methods, including establishing seemingly legitimate company profiles and LinkedIn presences to appear credible.
According to the security bulletin, the attacks often begin with a video call framed as a positive opportunity – a job, project, or contract. This call is then used as a vector to either convince the target to install malicious software, such as a fake audio codec, or to execute a command, potentially through copying and pasting it from a compromised source. As stated in the bulletin, “A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).”
Rust developers are being urged to remain vigilant and ensure their accounts are secured with multi-factor authentication and other security safeguards.
Read the original coverage
💬 Comments
📜 Comment Policy