Rust developers and package owners on crates.io are being targeted by recruiters. The Rust team has warned of fake interviews in which victims are being tricked into running malicious code.
Rust developers and package owners on crates.io are being targeted by recruiters. The Rust team has warned of fake interviews in which victims are being tricked into running malicious code.
This is reported by The Register.
Fraudsters offer a job, project, or contract, and then schedule a video call. During the call, the other party may ask to install a supposedly missing audio codec or execute a command copied to the clipboard. To avoid suspicion, attackers create plausible company profiles and LinkedIn pages that can pass a cursory check.
The Rust community has already faced similar attacks this summer. For example, in June, developer Matt Mastracci, who maintains packages on crates.io, received an offer allegedly from Singaporean venture capital fund Lua Ventures. The correspondence and profiles looked convincing, although the company itself was no longer in operation at the time.
After the conversation, Mastracci was sent a “test task” — a TypeScript repository. Inside was a RAT — a remote access trojan. The malicious code was disguised so that it would run when the usual commands for the test task were executed. However, the developer noticed the suspicious files earlier and did not infect the main computer.
The Rust team saw how far a single package owner could go in August, when attackers likely gained access to the computer or credentials of the author of the popular crate arrayref package and published a malicious version of it. It only lasted 86 minutes on crates.io, but during that time it was downloaded 2,285 times.
Therefore, developers are advised to be especially attentive to unexpected job offers or contracts, check companies and interlocutors, create links to video calls themselves through familiar services, as well as check active account sessions and enable multi-factor authentication.
dev.ua has previously written about similar schemes. For example, in August, a Ukrainian developer talked about a technical interview during which he was asked to launch an infected GitHub repository.
