Rust Developers Hit by Fake Job Call Scam

Attackers are calling Rust developers with job offers, then using the video chat to get them to install malware or run code. The Rust project says the campaign is ongoing and aimed at its own team members and the people who maintain widely used crates.

The crates.io team and the security response working group issued the warning, describing a social engineering effort that combines fake recruitment with real-time technical deception.

How the fake calls work

The playbook starts with an unsolicited approach, usually framed as a job offer or a contract opportunity. Once the target agrees to a video call, the attackers pivot to a technical pretext. They claim an audio codec is missing from the call and ask the developer to install a piece of software to fix it. In other cases, they simply paste malicious code to the clipboard and convince the target to execute it.

The goal in both cases is the same: to get code running on a developer's machine so they can steal credentials tied to package repositories. With those credentials, the attackers can publish malicious versions of legitimate packages.

What makes the approach harder to dismiss is the setup. The Rust team says the attackers are creating new companies with LinkedIn pages that are convincing enough to pass a quick look. A developer who checks the company before the call may still see a plausible profile.

Two earlier incidents loom over the alert

The Rust team connected the current campaign to two earlier episodes. In June, many prominent Rust developers were targeted in a similar attack. In August, the arrayref crate was compromised for a short time through what the team described as similar attacks.

The team said it does not know whether all of these incidents are part of the same campaign.

SecurityWeek previously reported on the arrayref incident, which surfaced on August 20 and was linked to North Korean threat actors. The attackers had compromised the account of arrayref's developer and published several malicious crates.

In the new alert, the Rust team noted that North Korea is known to use this style of attack, which has also been seen outside the Rust community. It did not name a specific actor behind the current activity.

What the attackers are after

Package ecosystems like crates.io are high-value targets because a single compromised maintainer account can reach thousands of downstream projects. An attacker who controls a popular crate can push a malicious update that runs during builds, potentially harvesting secrets from CI systems or injecting code into software that ships to end users.

The video-call angle is a departure from the automated scanning and credential stuffing that often dominates supply chain attacks. It relies on human trust and the pressure of a live conversation, where a developer is focused on the call rather than on verifying the software they are being asked to install.

The Rust team's warning is notable because it names the target set directly. This is not a generic phishing alert. It identifies Rust-lang team members and owners of popular crates as the intended victims.

Advice for developers

The Rust team urged developers to be wary of unsolicited approaches. It recommended holding calls with new contacts on platforms they trust, preferably one they set up themselves, rather than a link supplied by the other party.

Developers should also check their accounts for anything unusual, ensure multi-factor authentication is enabled, and confirm there are no unrecognized logins.

The guidance tracks with what security responders typically recommend after a maintainer account compromise: rotate credentials, review recent package publications, and look for changes to repository settings or access tokens.

Why this is hard to spot

The attackers are not relying on a single technical flaw. They are building a pretext that survives basic scrutiny. A LinkedIn page for a new company, a job description that matches a developer's skills, and a video call that begins with normal conversation all work together to lower suspicion.

The request to install a codec or run a snippet comes after some rapport has been established. By then, the target may be thinking about the job rather than the technical oddity of a missing audio driver on a modern video platform.

Even careful developers can be caught off guard when the request sounds routine and the person on the other end appears to be a recruiter with a real company behind them.

The broader Rust ecosystem picture

Rust's package registry, crates.io, is maintained by a relatively small team, and many popular crates are run by individual developers or small groups. That structure makes maintainer accounts a concentrated point of failure. A successful takeover of one account can ripple across many dependent projects.

The Rust security response working group and the crates.io team issued the alert together, which suggests the warning is meant to reach both the core project and the wider community of crate authors. The team's decision to link the current activity to the June and August incidents, even while saying it does not know if they are all connected, gives developers a sense of the pattern rather than a single isolated event.

What the Rust team is not saying

The alert does not name a specific threat actor behind the current campaign. It notes that North Korea is known to use this style of attack and that the technique has been seen outside the Rust community, but it stops short of attribution.

The team also said it does not know whether the June targeting, the August arrayref compromise, and the current campaign are all part of the same operation. That leaves open the possibility of copycat activity or multiple groups using a similar playbook.

For developers, the practical takeaway is the same regardless of who is behind it: treat unsolicited recruitment outreach with caution, especially when it moves quickly to a video call and a request to install or run something.

Why it matters

Supply chain attacks on package ecosystems have moved from automated credential theft to direct human manipulation. If a developer with publish rights to a widely used crate can be talked into running code during a fake job interview, the barrier to a broad compromise is lower than many teams assume.

This suggests that security programs focused only on scanning dependencies and rotating tokens may miss the moment when an attacker is on a video call with a maintainer. For Rust projects specifically, the warning is a reminder that the trust placed in a maintainer's account is only as strong as the maintainer's ability to spot a pretext.

It could also mean that other language ecosystems with similar maintainer models face comparable risk, though the Rust team has not made that claim. What is clear from the alert is that the attackers are willing to invest time in building fake companies and holding live calls, which makes the approach harder to filter out with technical controls alone.

Developers who maintain packages should review their account activity, confirm multi-factor authentication is active, and be skeptical of any call that ends with a request to install software or run a pasted command.