Rustaceans warned of job interviews with a malicious payload

The Rust programming language project has issued a warning about potential security threats targeting its contributors and creators. Security engineer Adam Harvey explained that the tactics used are reminiscent of North Korean fake recruiter campaigns. During a conversation, attackers may attempt to install malicious software or execute commands on the victim's computer, often disguised as a job interview or project collaboration.

To appear legitimate, the attackers create new, seemingly genuine company profiles, including fake LinkedIn accounts. This warning comes after several recent attacks on the Rust community, including a false interview scheme from a Singaporean venture capital firm. Matt Mastracci, who manages packages on the Rust package registry, reported that the impostor business was ultimately found to be fraudulent.

The initial contact had been convincing enough to almost compromise Mastracci's computer with a remote access trojan (RAT). The malicious deployment of RATs aligns with a recent international advisory from agencies in Australia, Germany, Japan, and the United States. This advisory revealed that North Korean actors had exploited fake job interviews to compromise over 30,000 devices and steal more than $10 million.

Additionally, in August, a supply chain attack on Rust's package ecosystem resulted in malicious versions of the arrayref crate being distributed. The compromised versions were designed to download malware onto unsuspecting users' machines. It is believed that a maintainer's credentials were stolen rather than the attackers deliberately introducing the malware.

Harvey advised Rust developers to be cautious of unsolicited communications, even if they appear to be from reputable sources, and to conduct video calls through trusted platforms.