Fake Rust Job Interviews Push Malware on Devs

The Rust Project warned that attackers are approaching Rust contributors and crate maintainers with believable recruiter outreach and “company” profiles, then using interview video calls to trick targets into installing malware or running commands. The activity is described as similar to North Korean fake-recruiter campaigns and could lead to account takeover and malicious code being distributed through the Rust package ecosystem.

Key findings

• Attackers are targeting Rust contributors and crate owners with recruitment-style outreach intended to compromise devices and accounts.
• The lure involves setting up a positive-sounding video interview and then pushing the target to install software (e.g., a “missing audio codec”) or execute a command pasted via the clipboard.
• Attackers create “new but legitimate-seeming company profiles,” including plausible LinkedIn presences, to pass quick inspection.
• A June incident used fake interview approaches claiming to be a Singaporean venture capital firm; the outreach was convincing and nearly led to a remote access trojan (RAT) infection.
• Rust’s ecosystem also experienced a supply-chain incident where a maintainer’s credentials were likely compromised, enabling a popular crate to briefly distribute malware.

Who’s being targeted

• Commonly targeted roles: Software Developers, Engineering, DevOps, Open Source Program Office (OSPO), Security Awareness, Package Maintainers/Release Managers.
• Affected industries: Software development, Open source communities, Technology (developer tooling/package ecosystems).
• Attack channels: linkedin, vishing, email.
• Impersonated: Recruiter at a legitimate-seeming company (with LinkedIn presence), Singaporean venture capital firm (recruiting outreach).

Awareness takeaways

• Treat unsolicited recruiter or “opportunity” outreach, especially aimed at maintainers, as a high-risk event and verify the company independently before engaging.
• Never install software or run commands during an interview/video call to “fix” audio/video problems; stop and verify through your organization’s normal IT process.
• Recognize that developer account takeover can quickly become a supply-chain incident affecting many downstream users.
• Use only trusted, approved platforms for calls and collaboration, and be cautious of interview workflows that push you to unfamiliar tools or downloads.

Red flags to watch for

• Unsolicited recruiting message tied to a new/untested company profile
• Requests to install extra software during the interview (e.g., an audio codec)
• Instructions to run a command provided via clipboard during the call
• Company appears credible at first but basic verification shows issues (e.g., defunct business)
• Recruiting process leads toward installing/running unexpected software
• Unsolicited outreach specifically targeting maintainers of widely used packages