proomt

Search

Search posts, papers, and topics

All posts

Mozilla Automation TeamAdam Harvey1 min readintro

Be alert: targeted attacks on prominent Rustaceans

Read on rust-lang.orgHN 24·5 commentsLobsters 95

Summary

The Mozilla Automation Team warns of a targeted social‑engineering campaign aimed at Rust community members and popular crate owners, using fake video‑call offers to deliver malware. They advise staying skeptical of cold outreach, using trusted call platforms, enabling MFA, and reporting any concerns to Rust security contacts.

  • Attackers impersonate legitimate contacts via video calls to deliver malware or execute clipboard commands.
  • Initiate calls on platforms you already trust and verify the caller's identity before installing anything.
  • Enable MFA on all accounts and monitor for unexpected login activity.
  • Report suspicious activity to help@crates.io or security@rust-lang.org.

Rust developers and crate maintainers should care because compromised accounts can be used to publish malicious crates that affect the entire ecosystem.

5/10
securityrustcommunitysocial engineering

Related reading

  1. This Week in Rust 666

    This issue of *This Week in Rust* (2026‑08‑26) aggregates community news: official Rust announcements (maintainers‑in‑residence, next‑gen trait solver, supply‑chain attack on arrayref, function‑overloading experiment), a Mozilla JPEG‑XL tooling update, several observations (AI‑assisted C/C++ rewrites, enum‑to‑word speedup, compilation metadata shaving, driver state handling, async vs sync for a r…

    Mozilla Automation Teamthis-week-in-rust.org9 min

  2. This Week in Rust 668

    This issue of *This Week in Rust* (Sept 9 2026) aggregates community news, recent Rust releases, notable blog posts, a “crate of the week” (tokio‑rcu), and a long list of merged PRs across the compiler, std, Cargo, rustdoc, rustfmt, Clippy and rust‑analyzer. The most concrete technical highlight is the tokio‑rcu crate, an async‑aware userspace RCU implementation built on Tokio.

    Mozilla Automation Teamthis-week-in-rust.org10 min

  3. Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation

    The authors show that the classic trusting‑trust attack is not limited to compilers: by tampering with GNU strip they can inject a payload that propagates through NixOS's bootstrap and ends up in almost every binary of the final system. The attack succeeds on a real nixpkgs revision, building a full graphical installer while backdooring the majority of its binaries.

    arXiv cs.SE (Software Engineering)arxiv.org1 minpaperHN24159

  4. This Week in Rust 669

    This Week in Rust #669 is a curated roundup of community newsletters, project/tooling releases, blog posts, walkthroughs, research, the crate of the week, testing calls, and a detailed list of merged PRs across the Rust compiler, standard library, Cargo, rustfmt, Clippy, and rust‑analyzer, plus a brief compiler‑performance triage summary. No new RFCs were approved.

    Mozilla Automation Teamthis-week-in-rust.org9 min

  5. This Week in Rust 665

    This issue of This Week in Rust summarizes recent developments in the Rust ecosystem, including official updates, community projects like OxiSH, observations on language features, and core Rust project changes. It covers compiler, library, Cargo, Rustdoc, and Clippy updates, offering a broad overview of the language's progress.

    Mozilla Automation Teamthis-week-in-rust.org9 min

  6. This Week in Rust 667

    This issue of *This Week in Rust* (2026‑09‑02) aggregates recent Rust ecosystem activity: rustup 1.29.1 release, new project directors, foundation hires, tooling updates (wasmi 2.0, Rustdoc 33 % faster, async FFI framework), observations on Cargo scheduling, safety‑certified Rust product, DNS cache memory savings, Rust vs Go concurrency, const‑fn compile‑time tricks, and a list of 522 merged PRs…

    Mozilla Automation Teamthis-week-in-rust.org10 min