The Rust project warns that attackers are targeting contributors and crate owners through plausible company profiles and recruitment-style outreach designed to compromise devices or accounts.

A social engineering campaign is ongoing, aiming at Rust-lang team members and popular crate owners to hijack credentials and deploy malicious packages.

Security researchers link the arrayref incident to North Korean threat actors, noting similar attack patterns in other contexts, though no single actor is named for the current activity.

An international advisory highlights North Korean operators using fake interviews to compromise devices and steal money, reflecting a broader, documented threat landscape.

Advisories urge developers to be wary of unsolicited approaches, conduct calls on trusted platforms, enable multi-factor authentication, monitor accounts for unusual activity, and verify logins to prevent credential compromise.

An August supply chain incident involved malicious versions of the arrayref crate, briefly delivering malware and suggesting credential compromise rather than developer intent.

The campaign follows earlier Rust-related incidents in the summer, including fake interview schemes allegedly from a Singaporean VC firm that nearly infected a maintainer’s machine with a remote access trojan.

Attackers invite targets to video calls under pretenses like job offers, then persuade them to install software or paste malicious code, often citing missing audio codecs or similar excuses.

Video-call recruitment-style attacks leverage legitimate-seeming recruitment or project opportunities to coax targets into installing software or pasting commands.

To appear credible, attackers create new companies with convincing LinkedIn pages, tying the campaign to earlier incidents including a June targeting Rust developers and an August arrayref compromise.

The bogus company profiles and LinkedIn presences are designed to pass initial scrutiny, mirroring North Korean-style fake recruiter tactics.

The Rust team does not confirm all incidents are the same campaign but links them through a common social engineering tactic and recent compromises.