The Rust project warned of an active social engineering campaign targeting Rust team members and popular crate maintainers. Attackers pose as recruiters or contractors, lure developers into video calls, then trick them into installing software or running pasted code to steal credentials and publish malicious packages.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a LinkedIn message: “We’re hiring for a Rust contract role, can you jump on a quick video call?” Sounds great, right? Rust-lang warned: attackers are posing as recruiters, jumping on video calls, then telling crate maintainers to install a ‘missing audio codec’ or paste and run a command they drop into your clipboard. The goal is to hijack Rust developer credentials and push malicious crates, just like the earlier arrayref compromise. These fake companies even spin up convincing LinkedIn pages that pass a quick glance. If any interviewer asks you to install software or run commands during the call, stop immediately, end the call and report it to security before you touch your terminal.
The Rust Project warned that attackers are approaching Rust contributors and crate maintainers with believable recruiter outreach and “company” profiles, then using interview video calls to trick targets into installing malware or running commands. The activity is described as similar to North…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Researchers say a North Korea-aligned group is targeting Web3 and crypto professionals with fake recruiter outreach and “mandatory” online skill tests. During the test, victims are tricked into copying a terminal command to “fix” a camera/mic error, which installs remote-access malware and can lead…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
