PTIR — Daily Briefing — 2026-09-19
by
Executive Summary
The Rust project has confirmed an active campaign targeting Rust team members and maintainers of popular crates. Attackers establish plausible company and LinkedIn profiles, arrange job or contract video calls, then ask the target to install a supposed codec or execute a clipboard command. The objective is account and device compromise that can be used to publish malware through trusted packages.
Action Queue
Harden video-call and package-publishing habits
The Rust crates.io team and security response working group say the campaign is ongoing. A similar attack preceded the compromise of the arrayref crate, making this more than a hypothetical phishing pattern. The warning is aimed at prominent Rust contributors, but the technique applies to anyone whose GitHub, package-registry, website, or cloud credentials could provide supply-chain access.
Recommended action: Decline any “missing codec,” browser extension, installer, or copied terminal command presented during an unsolicited call. When dealing with a new contact, create the meeting yourself on a trusted platform. Then check GitHub and package-registry accounts for MFA, unfamiliar sessions, new tokens or SSH keys, and unexpected publishing activity.
- Urgency: Immediate
- Importance: ★★★★★
- Verified active: September 19, 2026
- Deadline: No fixed deadline; the Rust team describes the campaign as ongoing
- Cost: Free
- Requirements: Access to the security and session settings for relevant developer accounts
- Official advisory: Be alert: targeted attacks on prominent Rustaceans
Open Source
The campaign exploits maintainer trust rather than a flaw in Rust itself. Its supply-chain value comes from compromising a legitimate publisher, then distributing malware through an established package. Projects should ensure that release credentials are narrowly scoped, MFA-protected, and not stored on general-purpose developer machines when avoidable.
PKb Candidates
- Unexpected video-call checklist: Verify the person independently, create the meeting on a known platform, install nothing during the call, paste no commands, and end the session if urgency or secrecy is introduced.
- Publisher-account baseline: Record MFA methods, active sessions, tokens, SSH keys, package ownership, recovery contacts, and the normal release path so anomalies are easier to recognize.