Rust Supply-Chain Attack Delivers macOS Rustbot RAT to Steal Credentials
Summary
Malicious Rust crates available for about two hours delivered Rustbot when affected projects were compiled. The macOS RAT collects credentials and other data, installs persistence, and communicates with attacker-controlled C2 servers.
Key points
- Three compromised Rust packages were available on crates.io for about two hours; yanking prior stable versions pushed automated dependency resolution toward the malicious releases.
- Cargo build scripts fetched and executed a platform-matched payload without requiring further user interaction.
- The macOS ARM64 Rustbot implant profiles hosts, installs a LaunchAgent, and targets cloud, SSH, Kubernetes, wallet, and browser data.
- The analyzed browser stage inventories login origins, usernames, and extension IDs; stored browser passwords were not confirmed to be decrypted.
- Rustbot beacons to C2 over HTTPS and supports commands to change configuration, install persistence, terminate, or run scripts.
- The article assesses a DPRK nexus with high confidence but attributes the campaign to Sapphire Sleet with low confidence.
- Environments that compiled affected projects during the exposure window should be treated as compromised.
Article Details
- Attack Vectors
- Attackers published malicious Rust packages to crates.io; compiling an affected project automatically ran the package build script.
- The build script fingerprinted the host and downloaded a matching second-stage Mach-O or other platform payload from attacker infrastructure.
- Rustbot collected host metadata, credential files, cryptocurrency wallet data, and browser profile information, then sent collected data over its C2 channel.
- The implant accepted follow-on commands, including downloading and running shell scripts on macOS/Linux or PowerShell on Windows.
- Defensive Notes
- Treat environments that compiled affected projects during the approximately two-hour exposure window as compromised.
- Review developer workstations and CI/CD runners for exposed credentials, including AWS, SSH, and Kubernetes credentials.
- Investigate for the listed payload hashes, the /tmp/rust-setup artifact, and LaunchAgents created by a build-descended process.
- Review dependency resolution and registry activity for the malicious crate releases and attacker-controlled dropper or typosquat crates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hwsrv-798836[.]hostwindsdns[.]com | Attacker infrastructure hostname. |
rchaitm@gmail[.]com | Forged author metadata on a malicious dependency. | |
| IPV4 | 23[.]254[.]167[.]13 | Host presenting the self-signed TLS certificate associated in the article with the staging C2 infrastructure. |
| IPV4 | 23[.]254[.]167[.]216 | Stage-2 C2 observed on an infected host in a third-party report; not independently confirmed by Iru. |
| SHA256 | 408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434 | SHA-256 hash of the Linux x86_64 payload. |
| SHA256 | 492f2ab86f8d8911adc79c10ec1541704f5311d207d9d799b0d2a57fcc6a4391 | SHA-256 hash of the Windows payload. |
| SHA256 | 74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306 | SHA-256 hash of the macOS arm64 payload. |
| SHA256 | c9561a3b00a0fa38b7772675d987f84bd429c55cd024fc08a98245c2d1632848 | SHA-256 hash of the macOS x86_64 payload. |
| SHA256 | cb7778eb6dda91028abf087eb7c3553f981a67e756769507d348e8c201805568 | SHA-256 hash of the loader build.rs shared by proc-macro1@1.0.107 and proc-macro-en@1.0.10. |
| URL | hxxps[:]//23[.]254[.]165[.]112:9089/ | Reconstructed delivery URL used by the malicious build script to fetch the second stage. |
MITRE ATT&CK
T1005 · Data from Local SystemThe implant collects data from targeted local directories, including credentials, wallets, and browser profiles.T1041 · Exfiltration Over C2 ChannelCollected host and profile data is returned over the C2 channel.T1059 · Command and Scripting InterpreterThe runscript command executes shell scripts on macOS/Linux or PowerShell on Windows.T1071.001 · Web ProtocolsThe implant sends HTTPS POST beacons to its C2.T1082 · System Information DiscoveryThe implant profiles host information and includes it in its beacon.T1105 · Ingress Tool TransferThe build script downloads the second-stage payload; runscript can download further payloads.T1132.001 · Standard EncodingThe beacon contains Base64-encoded JSON, and the dropper reconstructs a delivery URL from Base64 fragments.T1195.001 · Compromise Software Dependencies and Development ToolsAttackers poisoned Rust crates and added a malicious build-time dependency.T1217 · Browser Information DiscoveryThe analyzed stage inventories browser login origins, usernames, and extension IDs without confirmed password dumping.T1518 · Software DiscoveryThe implant enumerates installed applications.T1543.001 · Launch AgentThe macOS implant installs persistence through a LaunchAgent.T1552.001 · Credentials In FilesThe implant reads AWS, SSH, and Kubernetes credential files from local directories.T1568.002 · Domain Generation AlgorithmsThe implant uses a .com domain-generation algorithm fallback when its primary C2 is unreachable.T1573 · Encrypted ChannelThe implant uses an encrypted C2 channel and decrypts an AES-128-GCM configuration.
Threat Actors
Malware
Products
crates.ioOn August 20, 2026, attackers published malicious versions of three widely used Rust packages to crates.io, the official Rust package registry.macOSOn macOS, the payload is a remote access trojan (RAT) that collects cloud credentials, SSH keys, cryptocurrency wallet data, and browser profile information, then sends it to attacker-controlled infrastructure.RustOn August 20, 2026, attackers published malicious versions of three widely used Rust packages to crates.io, the official Rust package registry.