Rust Security Team Warns of Targeted Social-Engineering Campaign Against Prominent Developers

Overview

The Rust security response working group and the crates.io team warned on September 17, 2026, that rust-lang members and owners of popular Rust crates are being targeted in an active campaign to compromise their devices and accounts, according to the Rust project’s own blog. The warning, independently reported the same day by Phoronix, describes attackers using fake video-call pretexts and impersonated company profiles to trick developers into installing malware or running malicious commands.

What We Know

“We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware,” the Rust security response working group and crates.io team wrote in the blog post.

According to the post, the attack follows a consistent pattern: “A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that’s used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard).” Phoronix quoted the identical passage in its own coverage of the warning.

The attackers reinforce the ruse with fabricated online presences: “These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection,” according to the Rust blog. Phoronix similarly described the tactics as “sophisticated social engineering tactics, including fabricated LinkedIn profiles posing as legitimate companies.”

The Rust team linked the warning to earlier incidents: “A previous attack of this form targeted many prominent Rust developers in June, and, last month, the arrayref crate was briefly compromised through similar attacks,” the blog post said. The arrayref incident referenced here was previously reported by The Machine Herald, when a malicious proc-macro1 package compromised the arrayref, internment, and append-only-vec crates before the Rust Security Response Team pulled them within roughly 90 minutes. The team said it does “not know if these are all a part of the same campaign” as the current warning, according to the Rust blog.

The post also attributes the tactics to a known actor type: “This attack style is known to be used by the DPRK, and has been seen outside of the Rust community as well,” the Rust blog said.

In response, the security response working group and crates.io team asked developers to exercise added caution: “Please take extra care in the near term,” the Rust blog said, adding, “Be appropriately suspicious of cold outreaches, and ensure that any calls you have with new people are on platforms you trust — ideally, try to be the one who sets up the call on a platform you already use.” They also asked developers to “re-check that your accounts look normal: MFA enabled, no unexpected logins on platforms that can track that, and so on,” per the same post. Phoronix similarly reported that the team is “urging developers to remain vigilant and implement security protections including multi-factor authentication on their accounts.”

Developers with concerns were directed to two contact channels: “[email protected] (for crates.io account concerns) and/or [email protected] (for any other concerns),” the Rust blog said.

What We Don’t Know

The Rust project has not confirmed whether the September campaign, the June wave of attacks on prominent Rust developers, and last month’s arrayref compromise are connected, stating only that it does not yet know if they are part of the same campaign. Neither the Rust blog nor Phoronix named any specific developers, companies impersonated, or accounts confirmed compromised in this latest wave, and no technical indicators of compromise — such as malware samples or specific fake company names — were published in either source.