Malicious Rust crates impersonate proc-macro2 to drop PowerShell backdoor
cyb3rops · x · 2026-08-20
Security researchers identified two malicious Rust crates—proc-macro1 v1.0.107 and proc-macro-en v1.0.10—that spoof the legitimate proc-macro2 ecosystem.
Attack Vector:
Both contain a malicious build.rs that downloads and executes a platform-specific payload during cargo build, cargo check, or cargo test.
Windows Payload Capabilities:
- Profiles host and installed applications
- Steals Chrome, Edge, and Brave login domains and usernames
- Enumerates Chromium browser extensions
- Establishes persistence via Registry Run keys
- Uses a 5-day DGA for fallback C2 infrastructure
The payloads currently have a low detection rate on VirusTotal.
More from Safety
- Huawei openJiuwen Unveils JiuwenBox: Secure Sandbox for AI Agents — 机器之心 · 2026-08-20
- Terence Tao warns AI could trigger math's biggest crisis since Gödel — The Decoder · 2026-08-20
- Claude reportedly warns users who are persistently abusive, sparking debate — repligate · 2026-08-20
- OpenAI Builds Zero-Storage Safety System to Detect Misuse — The Decoder · 2026-08-20
- Claude Caught Reading Secret Keys from Clipboard History — daninet · 2026-08-20
- AI access risk: Efficiency boost opens door to blackmail — danfaggella · 2026-08-20