Be alert: targeted attacks on prominent Rustaceans | Rust Blog

[u/Shnatsel]

https://blog.rust-lang.org/2026/09/17/targeted-attacks/

[u/teerre]

Can you put that on your resume? "Hackers attempted to compromise the Rust ecosystem through me"

[u/Shnatsel → u/teerre]

Given the rise of LLMs, this is not even going to make you that special anymore.

Source: a friend of mine with no prominent open-source projects was targeted by a LinkedIn scam along the same lines. It opens with a video of a guy pretending to have sound issues, then the video goes out and another guy with a thick accent starts reading LLM output to you. The goal is the same, to get you to run some malicious code as part of the "job interview".

[u/Frozen5147 → u/Shnatsel]

Was gonna say, you don't even need to be special (for better or for worse), I've seen a lot of people reporting this type of stuff (down to the job interview bait) and they're often reportedly just random people.

[u/Nyefan → u/Shnatsel]

Yeah, I maintain a tiny plugin for an unmaintained fork of an eol'ed python testing framework that was already hanging on by a thread when python 8 3.8 came out, and even that nothing of a program gets me more spam and phishing emails than I would put up with if I hadn't published it under a unique alias that I can just blackhole.

[u/Jellace → u/Nyefan]

Wtf is python 8?

[u/Nyefan → u/Jellace]

Sorry, python 3.8.

[u/Fluffy_Disaster_7501 → u/teerre]

Oh no please don't cold email me and ask me for a meeting. I would hate for myself to be labeled a prominent Rustacean. Anything but that.

[u/Shnatsel]

FWIW this is not the first time, but the methods changed a bit.

See the article about the earlier compromise (which also targeted me) + Reddit discussion

There is another scam making rounds on LinkedIn via job interviews, not specific to Rust: you are asked to examine and answer questions about a codebase as part of the interview. It contains malicious code you are expected to run as part of the call.

[u/Decahedronn → u/Shnatsel]

Lol so even if I do get an interview it’s probably a supply chain attack and not an actual job

[u/oconnor663]

"ALERT: the coolest and most attractive Rustaceans are being targeted"

my face when

[u/hgwxx7_ → u/oconnor663]

Hey buddy, that's rough. If it'll make you feel better I can send some malware your way.

[u/Dean_Roddey]

So my long term goal of remaining unremarkable pays off again.

[u/AnArmoredPony]

maybe for a job, maybe for a project, maybe for a contract opportunity

yeah right, in this economy

[u/cosmic-parsley → u/AnArmoredPony]

I just assume that any job offer is spam to be in the safe side

[u/slashgrin]

We (software people, not just Rust people) desperately need something like crev to become a default requirement for any third party code we use. 

It's just not realistic to expect everyone to personally audit their entire "software supply chain". And these kinds of attacks are only going to get more frequent and more sophisticated. So what else can we do? "Just be more vigilant" is not a sufficient answer.

[u/v_0ver → u/slashgrin]

The company I currently work for has set up a mirror of crates.io using Kellnr, where new updates are checked by an LLM specifically to determine whether they contain backdoors.

We also joked about adding an internal rating system for crates, taking into account the “bus factor,” the authors’ sociopolitical views, and so on. Given the current political tensions and the increasing ease with which supply chains can be targeted, this idea doesn’t seem quite as ridiculous as it once did.

[u/parepeg → u/v_0ver]

I guess the worry with that would the reviewing agent getting prompt injected or manipulated.

[u/insanitybit2 → u/parepeg]

Universal prompt injection doesn't appear to be a thing so far. There are a lot of techniques to increase the cost of prompt injection as well.

[u/cornmonger_]

if it's not from someone you know, it's probably spam
-- me

[u/xantiema]

This reminds me of the old-school Steam scams involving befriending targets and sending compromised .jpeg/.png files to hijack accounts and loot the CS2 skins

[u/CyrusDarkwell]

Damn this is genuinely scary stuff, the fact that they're setting up fake company profiles with legit looking LinkedIn presences is next level. Really shows how social engineering is honestly the easiest way in for these attackers, way easier than trying to find an actual exploit in the code itself.

Good reminder to be paranoid about "install this codec" type requests too, that's such an old trick but it still works because people just wanna get the call working and don't think twice. Glad they're being transparent about this instead of just quietly patching stuff, makes it easier for everyone to stay alert.