Rustaceans warned of job interviews with a malicious payload

The Rust programming language has issued a warning about potential threats to its contributors and contributors of packages in its vast ecosystem. Security engineer Adam Harvey explained that attackers have been mimicking legitimate job interviews, potentially infecting devices with malware. The strategy is akin to the fake recruiter tactics employed by North Korean hackers.

During a seemingly benign video call, victims may be tricked into installing software or executing commands, allowing the malware to infiltrate the system. Attackers are creating fake company profiles, complete with plausible LinkedIn pages, to evade scrutiny. Such incidents occurred in June, when Rust developers were lured with fake interviews from a nonexistent Singaporean venture capital firm.

Another attack in August involved malicious versions of the arrayref crate, which, despite being available for merely two hours, had already been downloaded over 245 million times. The malicious releases were likely the result of compromised credentials rather than deliberate actions from the Rust developers. Harvey advised Rust users to verify the authenticity of unsolicited job offers and to conduct interviews through secure channels.