Fake recruiters are working the Rust maintainers who can publish to crates.io
The Rust Project's crates.io team says attackers posing as recruiters are luring team members and popular crate owners onto video calls that end in a pasted command. In August, one hijacked account shipped malicious crates.
The Watch · Security desk
What happened
- The Rust Project's crates.io team and security response working group warned last week that attackers are luring lang team members and owners of popular crates onto video calls pitched as job or contract offers.
- Once the target is on the call, they are told to install software for a missing audio codec, or to execute malicious code the attackers have pasted into their clipboard.
- In August the attackers compromised the account of the arrayref crate's developer and published several malicious crates under it.
- A day after the Rust alert, international authorities said the Contagious Interview group infected more than 30,000 devices across over 100 countries between December 2025 and July 2026.
Why it matters
- Who's exposed exposure A maintainer's laptop and their publish rights sit on the same machine, so one successful call reaches every build that resolves the crate, not only the person who took the meeting.
- What it limits constraint An employer with crate maintainers on staff can mandate MFA and separate machines, but the decisive moment happens in a private message it never sees.
- Who has to decide decision Teams now have to decide whether signing material belongs on the same device that joins calls with strangers and opens their repositories.
Next story · Security · Sep 18
Joint advisory pins WaterPlum's fake recruiters to North Korea's 313 General BureauConfirmed8 publishers
"These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection," Adam Harvey, a software developer at the Rust Foundation, said [3]. A maintainer vetting a new contact sees that layer first.
The Rust team stopped short of attribution. It went as far as saying North Korea is known to use this style of attack, and it has been seen outside the Rust community, without identifying who is behind the current activity [10]. SecurityWeek reported that the arrayref compromise surfaced on August 20 and was linked to North Korean threat actors [8]. The Rust team also said it does not know whether the June targeting of prominent Rust developers, the August compromise, and the current approaches belong to one campaign [5].
The lure runs at volume. Contagious Interview, also tracked as WaterPlum, runs it against developers, package maintainers, IT professionals and job seekers generally, and is after cryptocurrency, credentials, intellectual property and access to specific organizations [11]. Thirty thousand devices over the eight months from December 2025 to July 2026 works out to at least 3,750 infections a month [17]. More than 7,000 wallets were drained or had credentials stolen, roughly one wallet for every four devices infected, and both counts are floors [18]. "Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims' employers, clients, or contracting parties. The actors can also use stolen sensitive information for extortion," the Japanese, US, Australian and German authorities said [13]. The same operation shares infrastructure and personnel with North Korea's IT worker scheme [14].
Every remedy in the Rust advisory is something one person does on one laptop. Be wary of unsolicited approaches, and where possible be the one who sets up the call [6]. Treat any request to install software or run a command as a red flag, and open unknown VSCode projects in Restricted Mode [16]. Run take-home assignments and unfamiliar code only in a disposable VM, never on the device that holds credentials, keys or signing material [15]. Harvey added multi-factor authentication and a review of recent logins [7].
What to watch
- Whether crates.io adds registry-side publishing controls for popular crates after this alert.
- Whether the Rust team or a government agency ties the June, August and September incidents to one actor.
- Whether a crate with a large dependent count ships malicious versions from a hijacked owner account.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives40
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Rust project's crates.io team and security response working group warned last week that an ongoing social engineering campaign is targeting Rust-lang team members and the owners of popular crates to hijack developer credentials and deploy malicious packages.
- [2]
The pattern described: a target is invited to a video call framed as a job, contract, or collaboration opportunity, then nudged into installing something or running an attacker-supplied command.
- [3]
"These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection," said Adam Harvey, a software developer at the Rust Foundation.
- [4]
Once on the call, the target is tricked into installing software under the pretext of a missing audio codec, or executing malicious code pasted to their clipboard.
- [5]
The Rust team connected the campaign to two earlier incidents: many prominent Rust developers were targeted in a similar attack in June, and the arrayref crate was compromised for a short time in August through similar attacks. It said it does not know whether all of these incidents are part of the same campaign.
- [6]
Rust's advisory urges maintainers to be wary of unsolicited approaches and, wherever possible, to be the one who sets up the call rather than accepting a link from someone they have just met.
- [7]
Harvey advised Rust developers to enable multi-factor authentication on their accounts and to review recent logins.
- [8]
SecurityWeek previously reported on the arrayref incident, which surfaced on August 20 and was linked to North Korean threat actors.
- [9]
The attackers had compromised the account of arrayref's developer and published several malicious crates.
- [10]
The Rust team noted that North Korea is known to use this style of attack, which has also been seen outside the Rust community, and it did not name a specific actor behind the current activity.
- [11]
The approach is popular with the North Korean state-sponsored Contagious Interview group, also known as WaterPlum, which is after cryptocurrency, credentials for all types of accounts, intellectual property and a way into specific organizations; other software developers, package maintainers, web developers, IT professionals and job seekers in general are also targeted.
- [12]
A day after Rust's warning, international authorities said that between December 2025 and July 2026 the Contagious Interview group infected over 30,000 devices across 100+ countries and stole funds or account credentials from over 7,000 cryptocurrency wallets.
- [13]
"Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims' employers, clients, or contracting parties. The actors can also use stolen sensitive information for extortion," Japanese, USA, Australian, and German authorities warned.
- [14]
Authorities found that Contagious Interview's hackers and the North Korean IT worker operation share infrastructure and personnel.
- [15]
The advisory tells developers to run take-home assignments or unfamiliar code only in a disposable virtual machine or sandbox, never on the device where they keep credentials, keys or signing material.
- [16]
The advisory tells developers to treat any request to install software or run a command as a red flag, and to avoid opening unknown VSCode projects or to open them in Restricted Mode.
- [17]
December 2025 to July 2026 is eight months, so more than 30,000 infected devices is an average of at least about 3,750 devices a month.
- [18]
More than 7,000 compromised wallets against more than 30,000 infected devices is roughly one wallet per four devices, about 23 percent, with both figures stated as minimums.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comNorth Korea’s job interview scam runs both ways
1 article · September 21, 2026
- securityweek.comRust Team Members and Popular Crate Owners Targeted via Video Calls
1 article · September 21, 2026
Topics and entities
Topics
- Software Supply Chain Security
- Open Source Maintainer Security
- North Korean state cyber operations
- Social Engineering and Voice Phishing
Entities
- crates.io
- arrayref
- Rust
- Contagious Interview
- Visual Studio Code