The Rust team warned of targeted attacks on language developers

The Rust team has officially reported a series of targeted cyberattacks aimed at prominent community members. The attackers use complex social engineering schemes, posing as recruiters to distribute malicious software under the guise of job offers.

The attack scheme involves sending personalized messages that appear to be legitimate hiring requests. During communication, victims are offered to download and run executable files that contain hidden backdoors. These tools allow attackers to gain unauthorized access to local development environments and accounts associated with code repositories.

Developers are recommended to be vigilant when receiving any job offers through third-party communication channels. The project team insists on mandatory verification of the sender's identity and the use of multi-factor authentication (MFA) for all work accounts. Any suspicious activities should be recorded and forwarded to the security service for analysis.

The incident highlights the growing risks for open-source communities, where trust between participants becomes a vector for attacks on software supply chains. Details of the incident and recommendations for protecting infrastructure are available in the discussion on Lobsters. Currently, work is underway to identify the scale of the compromise and protect the affected accounts.