Fake recruiters are working the Rust maintainers who can publish to crates.io

"These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection," Adam Harvey, a software developer at the Rust Foundation, said ^[3]. A maintainer vetting a new contact sees that layer first.

The Rust team stopped short of attribution. It went as far as saying North Korea is known to use this style of attack, and it has been seen outside the Rust community, without identifying who is behind the current activity ^[9]. SecurityWeek reported that the arrayref compromise surfaced on August 20 and was linked to North Korean threat actors ^[7]. The Rust team also said it does not know whether the June targeting of prominent Rust developers, the August compromise, and the current approaches belong to one campaign ^[6].

The lure runs at volume. Contagious Interview, also tracked as WaterPlum, runs it against developers, package maintainers, IT professionals and job seekers generally, and is after cryptocurrency, credentials, intellectual property and access to specific organizations ^[10]. Thirty thousand devices over the eight months from December 2025 to July 2026 works out to at least 3,750 infections a month ^[1]. More than 7,000 wallets were drained or had credentials stolen, roughly one wallet for every four devices infected, and both counts are floors ^[2]. "Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims' employers, clients, or contracting parties. The actors can also use stolen sensitive information for extortion," the Japanese, US, Australian and German authorities said ^[12]. The same operation shares infrastructure and personnel with North Korea's IT worker scheme ^[13].

Every remedy in the Rust advisory is something one person does on one laptop. Be wary of unsolicited approaches, and where possible be the one who sets up the call ^[14]. Treat any request to install software or run a command as a red flag, and open unknown VSCode projects in Restricted Mode ^[17]. Run take-home assignments and unfamiliar code only in a disposable VM, never on the device that holds credentials, keys or signing material ^[15]. Harvey added multi-factor authentication and a review of recent logins ^[16].