An unknown group suspected to be North Korean state hackers targeted Rust language team members and high-profile package (“crate”) maintainers with phishing that lures victims into a fake conference call. When the victim tries to join, they are told they must install a “video codec” or update conferencing software, but the download is malware. The same roundup also describes “ClickFix” attacks where a fake captcha-like prompt convinces users to paste commands into a terminal, enabling malware installation and potential takeover of privileged apps like Meta’s Muse agent.
This attack targeted Rust language team members and high-profile crate maintainers with a phishing lure disguised as a collaboration request. The pretext was simple: an invite to join a conference call to discuss a feature request or bug report. Once the target attempted to join, a fake error appeared claiming a new video codec or updated conferencing software was required. The download link provided was malware rather than any legitimate update.
A related technique described in the same roundup, known as ClickFix, uses a different delivery mechanism. A compromised website presents users with an authentication prompt that resembles a captcha, but instructs them to copy a block of text and paste it into a terminal to generate an authentication token. The text is actually an encoded payload that installs malware, in some cases enabling access to privileged tools like microphone or screen recording agents.
Both techniques exploit trust in everyday developer workflows. A conference call invite tied to real project work, such as a feature or bug report, looks routine to a maintainer who regularly collaborates with contributors. The fake codec error mimics a common, believable technical hiccup that many users have encountered with legitimate conferencing software.
The ClickFix approach succeeds because it frames a dangerous action, running an unknown command in a terminal, as a normal verification step. Developers and technical staff, who are comfortable using terminals, may be less suspicious of this request than the average user would be of a random download link.
Organizations, especially those supporting open source maintainers and development teams, should reinforce a few habits. Treat unexpected meeting invites as potential phishing until verified through a trusted channel. Never install codecs or meeting software updates from links shown in pop-ups or error messages, relying only on approved update mechanisms. Most importantly, developers and general staff alike should be trained to never run terminal commands copied from a website or a verification prompt, since this has become a reliable way for attackers to install malware and gain access to privileged applications.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers sent phishing invites posing as a collaboration call about a feature or bug report, then presented a fake error claiming a new video codec or updated conferencing software was required to join, with the download actually being malware.
A ClickFix attack presents a captcha-like authentication prompt on a compromised website that instructs the user to copy a block of text and run it in a terminal to generate an authentication token, but the text is actually an encoded payload that installs malware.
Maintainers often have privileged access to code repositories and tools, and social engineering that leads to malware installation can be used to gain access to privileged applications, including those with microphone or screen recording permissions.
Unexpected meeting invites pushing urgent software installs, conferencing errors that direct downloads outside approved app stores, and any website asking users to run terminal commands to verify identity.
Imagine this: you’re a Rust maintainer, and you get a slick invite to a ‘quick conference call’ about a new feature or bug report. You click to join, the browser opens, and a fake conferencing error pops up: it says you need a new video codec or updated meeting software, with a big download button, that file is malware. Same playbook with ClickFix: a compromised site shows a captcha‑style box telling you to copy a big block of gibberish into your terminal to ‘generate an authentication token’. That block is an encoded payload to install malware and grab access to tools with mic or screen recording. Here’s the move: if a meeting invite or website tells you to install a ‘codec’ or run terminal commands, stop and verify it through our normal channels before you do anything.
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
A weekly threat bulletin highlights a North Korea–linked campaign where attackers posed as AI or blockchain employers to trick IT professionals into getting infected and losing cryptocurrency. It also notes a phishing kit that abuses Microsoft’s legitimate device login flow to gain long-lasting…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
