Loading story…
A phishing campaign is targeting crates.io users with emails impersonating the Rust Foundation, urging recipients to log in to protect their packages. The emails originate from rustfoundation.dev, a domain not controlled by the Rust Foundation, and aim to steal GitHub credentials. There is no evidence of a compromise of crates.io infrastructure, and the Rust team is working to take down the phishing domain and monitor for suspicious activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Rust project has warned that attackers are actively targeting prominent community members and maintainers of popular `crates.io` packages in an apparent effort to compromise accounts and publish malware through trusted Rust crates. The attackers use credible-looking fictitious company websites and LinkedIn profiles to approach targets with seemingly legitimate job, project, or contract opportunities and arrange video calls. During the calls, the operators pressure targets to install a supposed missing audio codec or run commands, including commands copied through the clipboard, to gain access to devices or maintainer accounts. Rust advised maintainers to treat unsolicited outreach with skepticism, use trusted conferencing platforms, and review MFA and account-login activity; reporting has linked the tactic to prior DPRK-associated activity, including the brief compromise of the `arrayref` crate, though attribution for the current campaign is unconfirmed.
Sep 20, 2026
Two malicious Rust packages, named 'faster_log' and 'async_println', were discovered on the official Crates.io repository, where they were designed to steal private keys from cryptocurrency wallets, specifically targeting Solana and Ethereum users. These packages were downloaded nearly 8,500 times before their removal, with 'faster_log' accounting for 7,200 downloads and 'async_println' for 1,200. The malicious crates impersonated the legitimate 'fast_log' crate by copying its README file, repository metadata, and maintaining the original logging functionality to avoid suspicion among developers. The attackers embedded a payload within the crates that, upon execution, scanned the victim's environment and project source files for sensitive information, including hex strings resembling Ethereum private keys, Base58 strings similar to Solana keys or addresses, and bracketed byte arrays that could contain keys or seeds. When such data was found, it was bundled with the file path and line number and exfiltrated to a hardcoded Cloudflare Worker URL, which was confirmed to be live and accepting POST requests during the investigation. The malicious activity was discovered by researchers at the code security company Socket, who promptly reported it to Crates.io. In response, Crates.io removed both packages and suspended the publishing accounts, 'rustguruman' and 'dumbnbased', on September 24th. The incident highlights the risks associated with open-source software supply chains, where attackers can leverage trusted repositories to distribute malware to unsuspecting developers. The malicious crates did not have any dependent downstream crates, which may have limited the spread of the compromise. The attack demonstrates the sophistication of threat actors in mimicking legitimate projects to evade detection and the importance of vigilant monitoring of package repositories. The use of a legitimate logging functionality within the malicious crates further reduced suspicion, allowing the packages to remain undetected for several months. The exfiltration endpoint used by the attackers was not an official Solana RPC endpoint, indicating a deliberate attempt to disguise the data theft operation. This supply chain attack underscores the need for developers to verify the authenticity of third-party packages and for repository maintainers to implement robust security controls. The incident also serves as a warning to the broader cryptocurrency and developer communities about the ongoing threat of targeted attacks seeking to compromise digital assets through software dependencies. Security researchers continue to monitor for similar threats and advise immediate removal of the affected packages from any projects.
Jun 29, 2026
Threat researchers identified two malicious Rust crates, faster_log and async_println, that impersonated the legitimate fast_log library to steal Solana and Ethereum private keys from developers. The crates, published under the aliases rustguruman and dumbnbased, embedded routines to scan source files for wallet keys and exfiltrate them to a hardcoded command and control endpoint. Combined, the malicious packages were downloaded over 8,400 times before being reported and removed from the Rust package registry. The Crates security team responded promptly by removing the listings, locking the associated accounts, and publishing a security advisory to alert the community. This incident highlights the ongoing risk of supply chain attacks in open source ecosystems and the importance of vigilant package vetting.
Jun 29, 2026