Rust Team Members and Popular Crate Owners Targeted via Video Calls

The Rust project warned last week that an ongoing social engineering campaign is targeting Rust-lang team members and the owners of popular crates to hijack developer credentials and deploy malicious packages.

The crates.io team and the security response working group issued the warning. According to the alert, attackers lure targets into video calls under the guise of job offers or contract opportunities.

Once on the call, the target is tricked into installing software under the pretext of a missing audio codec or executing malicious code pasted to their clipboard.

To lend the approach credibility, the attackers are creating new companies with pages convincing enough to pass a quick look.

The Rust team connected the campaign to two earlier incidents. Many prominent Rust developers were targeted in a similar attack in June , and the arrayref crate was compromised for a short time in August through what the team described as similar attacks. It said it does not know whether all of these incidents are part of the same campaign.

SecurityWeek previously reported on the arrayref incident , which surfaced on August 20 and was linked to North Korean threat actors. The attackers had compromised the account of arrayref’s developer and published several malicious crates.

In the new alert, the Rust team noted that North Korea is known to use this style of attack, which has also been seen outside the Rust community. It did not name a specific actor behind the current activity.

Developers have been urged to be wary of unsolicited approaches and to hold calls with new contacts on platforms they trust, preferably one they set up themselves. They should also check their accounts for anything unusual, ensure multi-factor authentication is enabled, and confirm there are no unrecognized logins.

Related : Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages

Related : Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

Related : Multiple Jscrambler Packages Impacted by Supply Chain Attack

CrowdSec Confirms Source Code Stolen in Supply Chain Attack

The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack.

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

North Korean Hackers Deploy New Linux Espionage Toolkit

The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.

Rust Supply Chain Attack Linked to North Korean Hackers

Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.

Supply Chain Security

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.

Supply Chain Security

Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack

LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks

The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials.