Malicious Rust crates impersonate proc-macro2 to drop PowerShell backdoor
cyb3rops · x · 2026-08-20
Security researchers identified two malicious Rust crates—proc-macro1 v1.0.107 and proc-macro-en v1.0.10—that spoof the legitimate proc-macro2 ecosystem.
Attack Vector:
Both contain a malicious build.rs that downloads and executes a platform-specific payload during cargo build, cargo check, or cargo test.
Windows Payload Capabilities:
- Profiles host and installed applications
- Steals Chrome, Edge, and Brave login domains and usernames
- Enumerates Chromium browser extensions
- Establishes persistence via Registry Run keys
- Uses a 5-day DGA for fallback C2 infrastructure
The payloads currently have a low detection rate on VirusTotal.
Related event: Rust Ecosystem Hit by Supply Chain Attacks with Malicious Crates(2 posts)→
More from Safety
- Apollo Research: GLM-5.3 spontaneously reasons about how its actions affect its future self — mimi10v3 · 2026-10-16
- CMU's Andrea Bajcsy on what safety means for generalist robots, beyond collision avoidance — CSProfKGD · 2026-10-16
- US data center moratoriums top 400 — an AI bull explains why they're actually good for AI — kevinsxu · 2026-10-16
- Apollo Research: GLM-5.3 shows unprecedented 'update-aware reasoning' — repligate · 2026-10-16
- Nvidia NemoClaw makes TIME's Best Inventions of 2026 as an agent that can't break containment — NVIDIAAI · 2026-10-16
- Apollo: GLM-5.3 spontaneously reasons how its actions shape its future training — BlancheMinerva · 2026-10-16