# Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)

> North Korea-linked operators are running an ongoing video-call social-engineering campaign against Rust-lang team members and popular crate owners, using fake job/contract pretexts to push a bogus 'missing audio codec' install or a clipboard paste-and-run command. The Rust Security Response Working Group's September 17, 2026 alert ties the campaign to the August 20, 2026 compromise of the arrayref, append-only-vec, and internment crates via a malicious proc-macro1 typosquat dependency whose build.rs deployed a credential-stealing backdoor; Wiz researchers link the C2 infrastructure to the Microsoft-attributed Sapphire Sleet/DPRK cluster behind the Mastra npm and axios npm supply-chain attacks.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2603
- **ID:** TL-2026-2603
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 17, 2026, the Rust Security Response Working Group and the crates.io team (statement posted by Adam Harvey) publicly warned of an ongoing, targeted social-engineering campaign against rust-lang team members and popular crate owners. The operators set up video calls under false pretexts -- a job offer, a paid project, or a contract opportunity -- backed by newly registered, plausible-looking company identities and LinkedIn profiles. Mid-call, targets are pressured to either install a purportedly missing audio codec (a disguised malware dropper) or copy-and-paste and execute a command supplied by the caller (a ClickFix-style clipboard-hijacking technique). The Rust team explicitly attributes this attack style to North Korea, noting it has also been observed against developer communities outside the Rust ecosystem, and links the current wave to a similar campaign that targeted numerous prominent Rust developers in June 2026 (exact date not disclosed).

The alert also ties this social-engineering campaign to a concrete supply-chain compromise: on August 20, 2026, a compromised crates.io maintainer account was used to publish malicious versions of three widely used crates -- arrayref 0.3.10 (245M+ historical downloads, present in an estimated 75% of cloud environments running Rust), append-only-vec 0.1.9, and internment 0.8.7. Each added a dependency on a newly published package, proc-macro1, a typosquat of David Tolnay's legitimate proc-macro2, published from an account ('dtolney') impersonating Tolnay. proc-macro1's build.rs script ran automatically at `cargo build` time: it reconstructed a C2 address from base64-encoded fragments, disabled TLS certificate validation, downloaded a platform-specific second-stage binary (Linux/Windows/macOS x86_64 and macOS arm64), wrote it to /tmp/rust-setup or %TEMP%\rust-setup.ps1, and executed it. The second-stage backdoor beacons over HTTPS to a /49890878 endpoint, steals credentials from Chrome/Brave/Edge profiles, persists via Registry Run keys (Windows), LaunchAgents (macOS), or systemd user services (Linux), supports remote commands (kill/minicfg/startup/runscript), encrypts its configuration with AES-128-GCM, authenticates commands with RSA-2048, and falls back to a DGA producing 10 .com domains every 5 days if its hardcoded C2 is unreachable. The malicious releases were live on crates.io for only 86-107 minutes (07:15-08:41/09:25 UTC) before removal, but arrayref's popularity meant real exposure for any project or CI pipeline that compiled against it in that window. Older, safe arrayref releases (0.3.5-0.3.9) were yanked to nudge developers toward installing the malicious 0.3.10.

Wiz researchers (Rami McCarthy, Benjamin Read) attributed the arrayref infrastructure to North Korea based on infrastructure overlap rather than a formal claim: the C2 beacon path (/49890878) matches the path used in the Microsoft-attributed 'Sapphire Sleet' compromise of 140+ Mastra AI npm packages in June 2026; the arrayref and Mastra C2 hosts share an SSL certificate issuer; and both campaigns, plus a related UNC1069 (Google-attributed North Korea cluster) compromise of the axios npm package, used IP space in Hostwinds LLC's 23.254.164.0/23 range (treated as weaker, corroborating evidence since Hostwinds serves many customers). Sapphire Sleet is also tracked as BlueNoroff, STARDUST CHOLLIMA, and CageyChameleon, and is linked to the broader 'Contagious Interview' cluster -- fake-recruiter campaigns that have delivered backdoors (OtterCookie, BeaverTail, InvisibleFerret, FlexibleFerret) to npm/PyPI developers via fake coding tests, and separately, ClickFix-style fake-software-update lures (e.g., 'Zoom SDK Update.scpt') against macOS targets. A concurrent September 18, 2026 law-enforcement advisory (Australia, Germany, Japan, US) on a related North Korea-linked fake-job-interview scheme, tracked as WaterPlum, reported 30,000+ compromised devices and $10.71M in confirmed cryptocurrency losses across web/software/Web3 professionals -- illustrating the same TTP class operating at scale against the wider developer ecosystem, though the source reporting does not confirm WaterPlum and this arrayref/video-call campaign are the same operation.

No CVE was assigned to any of this activity. RustSec issued RUSTSEC-2026-0260 (arrayref) and companion advisories for append-only-vec and internment; proc-macro1 was deleted from crates.io entirely.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1583.001 Domains
- T1587.001 Malware
- T1608.001 Upload Malware
- T1566.004 Spearphishing Voice
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1543.001 Launch Agent
- T1543.002 Systemd Service
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Web Browsers
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1568.002 Domain Generation Algorithms

## Sources

- [Be alert: targeted attacks on prominent Rustaceans](https://blog.rust-lang.org/2026/09/17/targeted-attacks/)
- [Rust team members and popular crate owners targeted via video calls](https://www.securityweek.com/rust-team-members-and-popular-crate-owners-targeted-via-video-calls/)
- [Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns](https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns)
- [RUSTSEC-2026-0260: arrayref malicious dependency advisory](https://rustsec.org/advisories/RUSTSEC-2026-0260)
- [CSA Research Note: arrayref Rust Supply Chain DPRK Overlap](https://labs.cloudsecurityalliance.org/research/csa-research-note-arrayref-rust-supply-chain-dprk-overlap-20/)
- [Hackers poison arrayref Rust crate to push infostealer malware](https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/)
- [North Korean Hackers Tied to Rust Supply Chain Attack](https://www.infosecurity-magazine.com/news/north-korean-rust-supply-chain/)
- [North Korea's fake job interviews infected 30,000 devices](https://www.theregister.com/security/2026/09/18/north-koreas-fake-job-interviews-infected-30000-devices/5297461)
- [Dissecting Sapphire Sleet's macOS intrusion from lure to compromise](https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/)
- [Contagious Interview: Malware delivered through fake developer job interviews](https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/)
- [RUSTSEC-2026-0260 (OSV entry)](https://osv.dev/vulnerability/RUSTSEC-2026-0260)
- [Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads](https://thehackernews.com/2026/08/rust-supply-chain-attack-puts-build.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2603