North Korean-linked recruiters target Rust developers with malicious interview lures
Summary
Attackers posing as recruiters or collaborators are targeting Rust maintainers with requests to run code or install software. The article links the tactic to Contagious Interview and outlines guidance for developers and employers.
Key points
- The Rust Project warned that maintainers and crate developers are being approached with fake job, contract, or collaboration offers.
- Attackers use interview or collaboration calls to pressure targets into running commands, installing software, or entering credentials on malicious pages.
- The activity is associated with Contagious Interview, also known as WaterPlum, described as a North Korean operation.
- Authorities said the group infected more than 30,000 devices in over 100 countries between December 2025 and July 2026, and stole funds or credentials from more than 7,000 cryptocurrency wallets.
- Developers are advised to verify contacts independently, avoid unfamiliar commands and software, use disposable sandboxes for untrusted code, enable MFA, and review account logins.
- Organizations are advised to use EDR, limit access to code and credentials, and screen applicants for identity or location inconsistencies.
Article Details
- Event Type
- Warning that attackers linked to Contagious Interview are targeting Rust Project members and crate maintainers with fake job or collaboration offers to induce malicious code execution or credential disclosure.
- Impact
- The activity puts developers, package maintainers, IT workers, and job seekers at risk of device compromise, credential theft, cryptocurrency theft, and exposure of sensitive data. The article reports that international authorities attributed infections of over 30,000 devices across more than 100 countries and theft from over 7,000 cryptocurrency wallets to the group between December 2025 and July 2026. A recent Rust-targeting attack is not confirmed to be part of the same campaign.
MITRE ATT&CK
T1056 · Input CaptureVictims are directed to pages designed to capture their account credentials.T1078 · Valid AccountsThe article reports stolen credentials being used to access victims' accounts.T1204 · User ExecutionVictims are persuaded to run attacker-supplied commands, install software, or execute unfamiliar code.T1566 · PhishingAttackers contact targets through social media, job platforms, and unsolicited job or collaboration offers.T1567 · Exfiltration Over Web ServiceStolen credentials may be used to exfiltrate cryptocurrency, personal data, and trade secrets.
People
Threat Actors
Products
crates.ioThe warning came last week from the Rust Project’s crates.io team and security response working group, and described a recurring pattern: a target is invited to a video call framed as a job, contract, or collaborationRustRust Project maintainers and crate developers are being targeted by attackers who pose as recruiters or collaborators to trick victims into running malicious code or revealing credentials.VS CodeOn the technical side, it recommends deploying Endpoint Detection and Response (EDR) tooling to spot and block malicious behavior, and extends the above mentioned VS Code and untrusted-code cautions to corporate devices.