Attackers are targeting members of the Rust Project and maintainers of widely used crates (Rust code libraries), dangling attractive opportunities to compromise their devices and accounts and, ultimately, publish malware.
The warning came last week from the Rust Project’s crates.io team and security response working group, and described a recurring pattern: a target is invited to a video call framed as a job, contract, or collaboration opportunity, then nudged into installing something or running an attacker-supplied command.
“These attackers are setting up new but legitimate seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection,” Adam Harvey, a software developer at the Rust Foundation, explained.
Rust developers were hit by a similar wave in June, and last month the arrayref crate was briefly compromised through the same style of attack, but it’s difficult to tell yet whether this latest attack is part of the same campaign.
Meet Contagious Interview (aka WaterPlum)
Rust developers are not the only ones being targeted via this same approach: other software developers, package maintainers, web developers, IT professionals, and job seekers in general are in danger.
The approach is popular with North Korean state-sponsored attackers: the so-called Contagious Interview (aka WaterPlum) threat group, which is after cryptocurrency, credentials for all types of accounts, intellectual property, a way into specific organizations, and more.
These attacks have been going on for years and, just a day after Rust’s warning, international authorities said that – between December 2025 and July 2026 – the threat group has infected over 30,000 devices across 100+ countries and stolen funds or account credentials from over 7,000 cryptocurrency wallets.
They also found that Contagious Interview’s hackers and the North Korean IT worker operation share infrastructure and personnel.
From cold message to compromise
Contagious Interview attackers are after individuals and they usually pose as company recruiters, often from plausible AI / blockchain / NFT firms.
They usually:
- Contact their targets via LinkedIn, social media, or online job platforms.
- Convince the targets to participate in an online interview (usually with a coding component) or a general call exploring the possibility of a collaboration.
- Use various tricks – technical difficulties, interview requirements, etc. – to persuade the victims into running malicious code, installing malware, or entering their account credentials into a page designed to deliver them to the attackers.
“Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims’ employers, clients, or contracting parties. The actors can also use stolen sensitive information for extortion,” Japanese, USA, Australian, and German authorities warned.
Stolen IDs also feed North Korea’s IT worker scheme, helping funnel salaries back to the sanctioned regime.
DPRK IT workers get themselves hired into remote roles using stolen identities, they apply for jobs with real LinkedIn accounts of the impersonated people, and pay proxies to sit on camera while they feed them answers and control their machine during job interviews.
When they get the job, operators of laptop farms help them keep up the illusion of being located in the same country as the impersonated people.
What developers can do
The single most effective defense is controlling the terms of first contact. Rust’s advisory urges maintainers to be wary of unsolicited approaches and, wherever possible, to be the one who sets up the call rather than accepting a link from someone they’ve just “met”.
Beyond that, they should:
- Verify recruiters and companies independently and in depth.
- Treat any request to install software or run a command as a red flag, no matter how routine it sounds (“install this codec,” “just run this to fix your setup,” “clone the repo and run the build”).
- Run take-home assignments or unfamiliar code only in a disposable virtual machine or sandbox, never on the device where they keep credentials, keys, or signing material.
- Avoid running scripts if they don’t understand exactly what they do.
- Avoid opening unknown VSCode projects (or open them in “Restricted Mode”).
Harvey also advised Rust developers to enable multi-factor authentication on their accounts and to review recent logins on platforms that expose them. Individuals that have been affected should reach out to the Crates.io team or the Rust Project’s security team for help.
What companies can do
Organizations face the threat from two sides: their developers can be compromised, and their hiring pipeline can be exploited to bring North Korean IT workers on board.
The international authorities’ advisory addresses both risks.
On the technical side, it recommends deploying Endpoint Detection and Response (EDR) tooling to spot and block malicious behavior, and extends the above mentioned VS Code and untrusted-code cautions to corporate devices.
On hiring, the advisory lists screening measures drawn from a real case in which a Japanese exchange spotted and rejected a suspected operative:
- Be suspicious when a normally low-volume role suddenly draws a flood of applications.
- Check that an applicant’s IP address matches their claimed location.
- Verify contact details and confirm certifications.
- In interviews, ask candidates to explain the skills on their resume in depth, and ask questions about their hometown, local weather, or hobbies that are hard for an impersonator to field.
- Treat requests to be paid in cryptocurrency, or to route pay to an account in someone else’s name, as warning signs.
- Watch for reluctance to meet in person, repeated audio or video freezes, background voices, and frequent glances at a second screen. Operators have also used AI face-swapping, then killed the video after a few minutes citing connection trouble.
Once someone is inside, the advisory stresses damage limitation: restrict access to source code, credentials, and systems to the minimum necessary, and if you find a contractor or subcontractor may be a North Korean IT worker, revoke their accounts and sessions promptly, and contact law enforcement (since knowingly paying these workers can itself breach sanctions).
See also:
North Korean remote workers are broadening their job hunt beyond IT
How well do you know your remote IT worker?
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!