Rust Team Warns of Video-Call Social Engineering Campaign Targeting Developers
Summary
The Rust team says attackers are targeting team members and popular crate owners with fake job offers and video calls to steal developer credentials and deploy malicious packages. The actor behind the current activity is unknown.
Key points
- Attackers reportedly lure Rust team members and popular crate owners into video calls posing as job or contract opportunities.
- Targets may be tricked into installing software disguised as an audio codec or executing malicious code copied to their clipboard.
- The attackers reportedly create companies with convincing LinkedIn pages to make their approaches appear legitimate.
- The Rust team linked the activity to similar attacks on prominent developers in June and the temporary compromise of the arrayref crate in August, but said it cannot confirm whether all incidents are connected.
- The current activity has not been attributed to a specific actor; the Rust team noted that North Korean actors are known to use this style of attack.
- The team advised developers to be wary of unsolicited approaches, use trusted platforms for calls, review account activity, enable multi-factor authentication, and check for unrecognized logins.
Article Details
- Event Type
- Social engineering campaign targeting Rust project team members and popular crate owners through video-call lures.
- Impact
- Attackers seek to hijack developer credentials and deploy malicious packages. Targets are tricked into installing software or executing malicious code copied to their clipboard. The article does not confirm successful compromise from the current activity.
MITRE ATT&CK
Products
crates.ioThe crates.io team and the security response working group issued the warning.LinkedInTo lend the approach credibility, the attackers are creating new companies with LinkedIn pages convincing enough to pass a quick look.RustThe Rust project warned last week that an ongoing social engineering campaign is targeting Rust-lang team members and the owners of popular crates to hijack developer credentials and deploy malicious packages.