"A video call is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," wrote Adam Harvey on the Rust blog.
How attackers are using video-call recruitment ruses, per Adam Harvey
Adam Harvey, a security-focused software engineer writing for the Rust project, described a targeted campaign that uses ostensibly positive outreach—job offers, projects, contract opportunities—as the initial lure. According to Harvey, attackers are establishing new, legitimate-seeming company profiles and plausible LinkedIn presences to pass cursory inspection, then using scheduled video calls as the vector to prompt targets to install software or run commands that compromise their machines or accounts.
June incident: a fake Singaporean VC and a near-RAT infection
Rust developers were targeted in June by fake interview approaches that purported to come from a Singaporean venture capital firm. Matt Mastracci, a maintainer who publishes packages on Rust's crates.io registry, said the recruiting business turned out to be defunct. Mastracci told the Rust project that the initial outreach appeared convincing and nearly resulted in his machine being infected with a remote access trojan (RAT).
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageAugust supply-chain hit: malicious arrayref releases and credential compromise
In August the Rust package ecosystem suffered a supply-chain attack when malicious versions of the arrayref crate were published that downloaded malware onto users' machines. Arrayref has recorded 245 million downloads over its lifetime, amplifying the potential reach; the malicious releases were available for less than two hours. Published evidence pointed toward a compromised maintainer credential as the likely root cause, rather than deliberate action by the project's developers.
International advisory: links to North Korean fake-interview campaigns
Harvey noted the resemblance between these Rust-focused tactics and activity described in an international advisory issued the previous week by agencies in Australia, Germany, Japan, and the United States. That advisory said North Korean operators had used fake job interviews to compromise more than 30,000 devices and steal over $10 million—parallels that underline the strategic use of recruitment ruses and remote-access tooling in these campaigns.
What this means for Rust contributors, crate owners, and security teams
- Maintainers and crate owners: The arrayref incident suggested maintainer credentials were compromised, making credential protection and rapid response to unexpected account activity concrete priorities for anyone who controls publishing keys or package repositories.
- Security teams and platform operators: The pattern of convincing, fabricated company profiles and video-call vectors—coupled with a documented international advisory—means detection strategies should consider social-engineering chains that begin outside technical channels and culminate in local execution or credential theft.
- Downstream users and package consumers: The fact that a widely downloaded crate (245 million lifetime downloads for arrayref) briefly hosted malicious releases underscores how quickly a short window of compromise can reach large numbers of users; timing and provenance checks gain urgency in that context.
Rust project's guidance: scrutinize unsolicited approaches and use trusted platforms
Harvey urged Rust contributors and crate owners to scrutinize unsolicited approaches even when they appear legitimate, and to conduct calls through trusted platforms. The combination of convincing social engineering, short-lived malicious package releases, and evidence pointing to credential compromise frames the immediate defensive posture the Rust project is recommending.
The incidents reported over the summer—June's near-RAT deployment via a fake VC interview and August's brief, malicious arrayref releases—are not isolated anecdotes in Harvey's account but linked examples of how recruitment-style social engineering and supply-chain compromise can intersect. The Rust project's warning leaves a narrow practical task: validate provenance, protect credentials, and treat unexpected outreach with skepticism even when it seems to come from a plausible source.
