8 ms·

Crates.io phishing attempt

156 points by dmarto 1y ago

Rust Blog Post: https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/ https://blog.rust-lang.org/2025/09/12/crates-io-phishing-cam...

amai 1y ago
https://pypi.org/ https://pypi.org/ is next.
dmarto 1y ago
Heh, the phishing page now redirects to a rickroll.
- autoexec 1y ago
  All I get is the message "onto the next package manager. WHOHOOO! - stdout"
  - dmarto 1y ago
    And now the phishing page is advertising data for sale: > crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<) So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.
shepmaster 1y ago
An official post about this is at https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/ https://blog.rust-lang.org/2025/09/12/crates-io-phishing-cam...
coldfoundry 1y ago
Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.
- koakuma-chan 1y ago
  Phishing attempts are usually low-effort and easily seen through, npmjs.help one was good though.
  - stronglikedan 1y ago
    > low-effort and easily seen through To make up for that, they cast a wide net. It's a numbers game, like the guys that ask every single woman they meet for their phone number. It costs nothing or next to it, and all you need is one for a payoff.
    - koakuma-chan 1y ago
      I think that if you actually make a proper phishing website, get an actually plausible domain, and not make spelling mistakes, you can increase your conversion rate dramatically. Also why do they ask for a phone number if you can just ask her out right away.
- alexsmirnov 1y ago
  Phishing is dumb and easy to detect by purpose. I's to filter victims who are an easy target.
- diggan 1y ago
  > Why does it seem like phishing is popular again? Was it ever not popular? Looking at my spam box, I receive countless of phishing attempts per week, and doing some quick queries of the total count over time, it seems to more or less been the same for the last 2-3 years at the very least. I'm not sure why it's such big news all of a sudden, probably because it recently succeeded against a developer of some popular npm packages? I think most people either have the phishing emails flagged, so they never see them. The ones that get seen, get ignored as obvious phishing. And for the ones that click the link, their password manager would stop them from entering their detail. And then you have the final 0.0001% who never protected themselves, and were tired/stressed at that very moment, and fell for it. So I guess ultimately it's bound to become news every now and then, until everyone finally got the memo to get a proper password manager that don't show accounts that don't belong to the domain.
prameshbajra 1y ago
That email looked very genuine. I would have fallen for it. Not gonna lie.
- twodave 1y ago
  Being asked to login via an “internal login page” is a huge, bright red flag. It doesn’t matter what the reasoning is, if it’s not the same domain or an SSO integration that is well known to both you and the vendor then you shouldn’t be using it. This is security 101 type stuff.
- hu3 1y ago
  I've grown old enough to ignore sense of urgency when coupled with authentication. That e-mail does not pass my sniff test.
- burntsushi 1y ago
  My bluesky post was the one quoted in the OP. I do think it was a decent attempt. A phishing attempt making it past gmail's spam filter is somewhat rare for me. Certainly less than weekly. And something this targeted is definitely a ~yearly occurrence (or less). The major tip-offs for me were: 1. It was weird to be getting this from the Rust Foundation. The phishers likely don't understand Rust's governance structure. It's a common misconception shared by outsiders. 2. If a security incident like this would have occurred, there would have 100% been some kind of public communication about it on the rust-lang.org domain. I get notified whenever there's a new post there. So I knew this wasn't referencing a real event. 3. I also knew that crates.io doesn't manage authentication. It farms that out to GitHub. So the crates.io people wouldn't be communicating to me about my GitHub credentials being compromised. It didn't make sense. And then finally, the URL is funny. The somewhat scary part here though is that all of my points above come from being pretty dialed into the Rust organization and how things actually work. But yeah, as a general rule of thumb, I always question any email asking me to log into something that wasn't just activated by me (like a "forgot my password" flow or something). Finally, when I worked at Salesforce, the IT team there would occasionally send out fake phishing emails and ask you to report them to the team. I never fell for one, but I assume if I had, I would have been notified about it. I thought it was a very effective campaign because it always kept me on my toes.
vlovich123 1y ago
Seems like identical approach to the npm phishing attempts. There was some good suggestions last time like locking down the ability to upload packages for a few days after a security change.
ranger207 1y ago
If you get a message (text, email or call), it's best to not trust the contents of the message until you verify it by logging in or whatever yourself. If crates.io says you have a problem, close the email and go to crates.io yourself. If your bank calls you, hang up and log in or call their support number yourself. Don't trust anyone contacting you for sensitive stuff
- warwren 1y ago
  Sage advice
- larrik 1y ago
  Definitely. I get scammers calling me from a caller id that claims to be my bank asking about suspicious charges, and they know my name and have my account info, but they ask for my full credit card number to "verify" it. Yet, they give different suspicious charges every time you ask. The worst part is that when I call the bank to see if its legit, they are much less pleasant to deal with than the scammers...
  - pipo234 1y ago
    > The worst part is that when I call the bank to see if its legit, they are much less pleasant to deal with than the scammers... +1 This is so true. I just never realized that is why I'm always tempted to not bother doing the right thing.
  - SketchySeaBeast 1y ago
    I've stopped trying to call - if I think there's a problem I go into my local branch. Much harder to put me on hold for 40 minutes and then hang up in person.
  - mdaniel 1y ago
    I just realized that's an excellent opportunity for "reverse phishing:" you can mangle the first 4 digits of your card [or make one up wholesale] and if they say "thank you, sir" you know they are fake. The real bank will spot that mistake instantly since that prefix is per financial institution
otterley 1y ago
GitHub supports passkeys. Just a friendly reminder for everyone to update their accounts to require passkey auth to prevent credential stealing. https://docs.github.com/en/authentication/authenticating-with-a-passkey https://docs.github.com/en/authentication/authenticating-wit...
- quectophoton 1y ago
  This prompted me to check, and seems like KeePassXC supports storing passkeys, at least if you use the browser extension and enable a flag in its config. Until now I had thought it only supported unlocking your database with passkeys, I didn't know about it being able to actually store them. I guess I'll try setting them up on some unimportant website to see for myself what all the hype is about.
  - otterley 1y ago
    Whatever you do, don't export passkeys with KeePassXC. It exports them in the clear. It's not considered kosher to export passkeys from any credential manager's data store anyway.
hombre_fatal 1y ago
I got an official email from Paypal last week saying that I had a charge for $900 at Kraken, and to call some number if it's suspicious. What's great about the attack is that it's sent from paypal.com and signed by paypal. And the email contains a legit link to paypal, not some phishing site. But the phone number is the attack. The attack: 1. Register a paypal business account 2. Add the victim's email address (or one that forwards to them) to the biz account's "secondary users" 3. Add a custom invitation message about how they have a $900 charge that they need to contest by calling a phone number that you control. 4. Paypal shows your custom invitation message inline with their official email with no indication that it was written by someone other than paypal (wtf?) Here's the email that was of course surrounded by Paypal's own official email chrome: > New Profile Charge: We have detected a new payment profile with a charge of $910.45 USD at Kraken.com. To dispute, contact PayPal at (805) 500-8413. Otherwise, no action is required. PayPal accept automatic pending bill from this account.Your New PayPal Account added you to the Crypto Wallet account. I called the number and some guy started asking me for my info starting with my full name. I didn't hang around on the call long enough to see what the attack was.
- gbalduzzi 1y ago
  Let's say someone falls for this. What happens next, when they become the business account secondary user?
  - hombre_fatal 1y ago
    I added to my comment, but when you call the number, you talk to the attacker and they ask you questions about you and your account. Maybe they try to buy crypto with it or they prime you to go to some attack website and use your paypal account to buy something.
    - edm0nd 1y ago
      oh no, not at all. They will attempt to get you to install AnyDesk or some kind of remote software and then pwn your computer. They will remote in "to fix the hack" because your computer is obviously infected with a virus. Then either just steal your money from your bank account or etc.
arjie 1y ago
This is funny. The site https://github.rustfoundation.dev https://github.rustfoundation.dev now only contains a single image that is the buff doge vs cheems meme. Chad Rust Devs vs. Virgin NPM Devs Falling For Phishing Amusing. You have to ignore SSL to get the image since the site has HSTS enabled. A coincidence is that today I got a "two factor code from Coinbase. If you did not request this, call this number". Ho ho ho. Yes, I will call your number, Coinbase.
testdelacc1 1y ago
That's an exceptionally well crafted phishing email and landing page. It looks so real! Even the URL looks legit - github.rustfoundation.dev (the real URL is rustfoundation.org). Btw, if you go to https://rustfoundation.dev https://rustfoundation.dev right now it says in meme format: Virgin npm devs falling for phishing (sleepy doge) vs Chad Rust devs (shredded doge). As chad as Rust devs supposedly are, something tells me at least a few of them are going to fall for this attack.
- deleted 1y ago
  [deleted]
- carols10cents 1y ago
  Yeah, npm has orders of magnitude more users than crates.io. This attack's success, or lack thereof, has no bearing on the savviness of JavaScript or Rust developers.
- diggan 1y ago
  > That's an exceptionally well crafted phishing email and landing page I dunno, same was said about the npm email, but I think this one is even worse. First off, crates.io doesn't even do their own authentication, it's GitHub auth all the way. So that smells incredibly funny immediately. What information would even be compromised here, the GitHub profile's email? Secondly, why would the Rust foundation alert about this before the Crates/Cargo group does? It seems to come from the wrong people, but fair enough, most people don't have knowledge the Rust organizations I'm guessing. Thirdly, if there truly was an security issue with crates, I'd expect that to be plastered all over the internet, not the very least official Rust website and crates.io, immediately. They wouldn't wait and reach out to authors first, then publicly announce it. Would be my guess at least. In the end, a tired and/or stressed person could miss all of those things, which happens sometimes with phishing. We're all human after all, shit goes through the cracks sometimes, even to the best of us. That's why it's really important that people stop trying to fight phishing by manually preventing it by processes, or going to the website instead of clicking links and so on. Just get a password manager that can connects domains with credentials, then when the list of accounts don't show up when you expect it to, pay close attention to what's going on. Otherwise you can just move forward without much thinking.
deleted 1y ago
[deleted]

156 points by dmarto 1y ago

Rust Blog Post: https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/ https://blog.rust-lang.org/2025/09/12/crates-io-phishing-cam...

amai 1y ago

https://pypi.org/ https://pypi.org/ is next.

dmarto 1y ago

Heh, the phishing page now redirects to a rickroll.

autoexec 1y ago
All I get is the message "onto the next package manager. WHOHOOO! - stdout"
- dmarto 1y ago
  And now the phishing page is advertising data for sale: > crates.io db along with juicy tokens for sale. email for buying! (free leak if no offer till sunday >.<) So far: rickroll → Strong Dog vs Weak Dog meme → future plans → advertisement.

shepmaster 1y ago

An official post about this is at https://blog.rust-lang.org/2025/09/12/crates-io-phishing-campaign/ https://blog.rust-lang.org/2025/09/12/crates-io-phishing-cam...

coldfoundry 1y ago

Why does it seem like phishing is popular again? Maybe bad actors forgot how gullible humans were? I get phishing attempts nearly daily via email or sms and I honestly thought “Who would fall for this?” every time one came in. The only phishing I can see that would be extremely hard to detect are browser extension injections (either in extension window or page replacement) so the domain is legitimate.

koakuma-chan 1y ago
Phishing attempts are usually low-effort and easily seen through, npmjs.help one was good though.
- stronglikedan 1y ago
  > low-effort and easily seen through To make up for that, they cast a wide net. It's a numbers game, like the guys that ask every single woman they meet for their phone number. It costs nothing or next to it, and all you need is one for a payoff.
  - koakuma-chan 1y ago
    I think that if you actually make a proper phishing website, get an actually plausible domain, and not make spelling mistakes, you can increase your conversion rate dramatically. Also why do they ask for a phone number if you can just ask her out right away.
alexsmirnov 1y ago
Phishing is dumb and easy to detect by purpose. I's to filter victims who are an easy target.
diggan 1y ago
> Why does it seem like phishing is popular again? Was it ever not popular? Looking at my spam box, I receive countless of phishing attempts per week, and doing some quick queries of the total count over time, it seems to more or less been the same for the last 2-3 years at the very least. I'm not sure why it's such big news all of a sudden, probably because it recently succeeded against a developer of some popular npm packages? I think most people either have the phishing emails flagged, so they never see them. The ones that get seen, get ignored as obvious phishing. And for the ones that click the link, their password manager would stop them from entering their detail. And then you have the final 0.0001% who never protected themselves, and were tired/stressed at that very moment, and fell for it. So I guess ultimately it's bound to become news every now and then, until everyone finally got the memo to get a proper password manager that don't show accounts that don't belong to the domain.

prameshbajra 1y ago

That email looked very genuine. I would have fallen for it. Not gonna lie.

twodave 1y ago
Being asked to login via an “internal login page” is a huge, bright red flag. It doesn’t matter what the reasoning is, if it’s not the same domain or an SSO integration that is well known to both you and the vendor then you shouldn’t be using it. This is security 101 type stuff.
hu3 1y ago
I've grown old enough to ignore sense of urgency when coupled with authentication. That e-mail does not pass my sniff test.
burntsushi 1y ago
My bluesky post was the one quoted in the OP. I do think it was a decent attempt. A phishing attempt making it past gmail's spam filter is somewhat rare for me. Certainly less than weekly. And something this targeted is definitely a ~yearly occurrence (or less). The major tip-offs for me were: 1. It was weird to be getting this from the Rust Foundation. The phishers likely don't understand Rust's governance structure. It's a common misconception shared by outsiders. 2. If a security incident like this would have occurred, there would have 100% been some kind of public communication about it on the rust-lang.org domain. I get notified whenever there's a new post there. So I knew this wasn't referencing a real event. 3. I also knew that crates.io doesn't manage authentication. It farms that out to GitHub. So the crates.io people wouldn't be communicating to me about my GitHub credentials being compromised. It didn't make sense. And then finally, the URL is funny. The somewhat scary part here though is that all of my points above come from being pretty dialed into the Rust organization and how things actually work. But yeah, as a general rule of thumb, I always question any email asking me to log into something that wasn't just activated by me (like a "forgot my password" flow or something). Finally, when I worked at Salesforce, the IT team there would occasionally send out fake phishing emails and ask you to report them to the team. I never fell for one, but I assume if I had, I would have been notified about it. I thought it was a very effective campaign because it always kept me on my toes.

vlovich123 1y ago

Seems like identical approach to the npm phishing attempts. There was some good suggestions last time like locking down the ability to upload packages for a few days after a security change.

ranger207 1y ago

If you get a message (text, email or call), it's best to not trust the contents of the message until you verify it by logging in or whatever yourself. If crates.io says you have a problem, close the email and go to crates.io yourself. If your bank calls you, hang up and log in or call their support number yourself. Don't trust anyone contacting you for sensitive stuff

warwren 1y ago
Sage advice
larrik 1y ago
Definitely. I get scammers calling me from a caller id that claims to be my bank asking about suspicious charges, and they know my name and have my account info, but they ask for my full credit card number to "verify" it. Yet, they give different suspicious charges every time you ask. The worst part is that when I call the bank to see if its legit, they are much less pleasant to deal with than the scammers...
- pipo234 1y ago
  > The worst part is that when I call the bank to see if its legit, they are much less pleasant to deal with than the scammers... +1 This is so true. I just never realized that is why I'm always tempted to not bother doing the right thing.
- SketchySeaBeast 1y ago
  I've stopped trying to call - if I think there's a problem I go into my local branch. Much harder to put me on hold for 40 minutes and then hang up in person.
- mdaniel 1y ago
  I just realized that's an excellent opportunity for "reverse phishing:" you can mangle the first 4 digits of your card [or make one up wholesale] and if they say "thank you, sir" you know they are fake. The real bank will spot that mistake instantly since that prefix is per financial institution

otterley 1y ago

GitHub supports passkeys. Just a friendly reminder for everyone to update their accounts to require passkey auth to prevent credential stealing. https://docs.github.com/en/authentication/authenticating-with-a-passkey https://docs.github.com/en/authentication/authenticating-wit...

quectophoton 1y ago
This prompted me to check, and seems like KeePassXC supports storing passkeys, at least if you use the browser extension and enable a flag in its config. Until now I had thought it only supported unlocking your database with passkeys, I didn't know about it being able to actually store them. I guess I'll try setting them up on some unimportant website to see for myself what all the hype is about.
- otterley 1y ago
  Whatever you do, don't export passkeys with KeePassXC. It exports them in the clear. It's not considered kosher to export passkeys from any credential manager's data store anyway.

hombre_fatal 1y ago

I got an official email from Paypal last week saying that I had a charge for $900 at Kraken, and to call some number if it's suspicious. What's great about the attack is that it's sent from paypal.com and signed by paypal. And the email contains a legit link to paypal, not some phishing site. But the phone number is the attack. The attack: 1. Register a paypal business account 2. Add the victim's email address (or one that forwards to them) to the biz account's "secondary users" 3. Add a custom invitation message about how they have a $900 charge that they need to contest by calling a phone number that you control. 4. Paypal shows your custom invitation message inline with their official email with no indication that it was written by someone other than paypal (wtf?) Here's the email that was of course surrounded by Paypal's own official email chrome: > New Profile Charge: We have detected a new payment profile with a charge of $910.45 USD at Kraken.com. To dispute, contact PayPal at (805) 500-8413. Otherwise, no action is required. PayPal accept automatic pending bill from this account.Your New PayPal Account added you to the Crypto Wallet account. I called the number and some guy started asking me for my info starting with my full name. I didn't hang around on the call long enough to see what the attack was.

gbalduzzi 1y ago
Let's say someone falls for this. What happens next, when they become the business account secondary user?
- hombre_fatal 1y ago
  I added to my comment, but when you call the number, you talk to the attacker and they ask you questions about you and your account. Maybe they try to buy crypto with it or they prime you to go to some attack website and use your paypal account to buy something.
  - edm0nd 1y ago
    oh no, not at all. They will attempt to get you to install AnyDesk or some kind of remote software and then pwn your computer. They will remote in "to fix the hack" because your computer is obviously infected with a virus. Then either just steal your money from your bank account or etc.

arjie 1y ago

This is funny. The site https://github.rustfoundation.dev https://github.rustfoundation.dev now only contains a single image that is the buff doge vs cheems meme. Chad Rust Devs vs. Virgin NPM Devs Falling For Phishing Amusing. You have to ignore SSL to get the image since the site has HSTS enabled. A coincidence is that today I got a "two factor code from Coinbase. If you did not request this, call this number". Ho ho ho. Yes, I will call your number, Coinbase.

testdelacc1 1y ago

That's an exceptionally well crafted phishing email and landing page. It looks so real! Even the URL looks legit - github.rustfoundation.dev (the real URL is rustfoundation.org). Btw, if you go to https://rustfoundation.dev https://rustfoundation.dev right now it says in meme format: Virgin npm devs falling for phishing (sleepy doge) vs Chad Rust devs (shredded doge). As chad as Rust devs supposedly are, something tells me at least a few of them are going to fall for this attack.

deleted 1y ago
[deleted]
carols10cents 1y ago
Yeah, npm has orders of magnitude more users than crates.io. This attack's success, or lack thereof, has no bearing on the savviness of JavaScript or Rust developers.
diggan 1y ago
> That's an exceptionally well crafted phishing email and landing page I dunno, same was said about the npm email, but I think this one is even worse. First off, crates.io doesn't even do their own authentication, it's GitHub auth all the way. So that smells incredibly funny immediately. What information would even be compromised here, the GitHub profile's email? Secondly, why would the Rust foundation alert about this before the Crates/Cargo group does? It seems to come from the wrong people, but fair enough, most people don't have knowledge the Rust organizations I'm guessing. Thirdly, if there truly was an security issue with crates, I'd expect that to be plastered all over the internet, not the very least official Rust website and crates.io, immediately. They wouldn't wait and reach out to authors first, then publicly announce it. Would be my guess at least. In the end, a tired and/or stressed person could miss all of those things, which happens sometimes with phishing. We're all human after all, shit goes through the cracks sometimes, even to the best of us. That's why it's really important that people stop trying to fight phishing by manually preventing it by processes, or going to the website instead of clicking links and so on. Just get a password manager that can connects domains with credentials, then when the list of accounts don't show up when you expect it to, pay close attention to what's going on. Otherwise you can just move forward without much thinking.

deleted 1y ago

[deleted]