Full Report
Malicious updates turned routine builds into a delivery system for infostealer malware
Analysis Summary
# Tool/Technique: Rust Supply Chain Poisoning (proc-macro1)
## Overview
This attack involves a supply chain compromise of the Rust ecosystem via the `crates.io` registry. Attackers compromised a legitimate maintainer's credentials to inject a malicious dependency (`proc-macro1`) into widely used packages. The malware utilizes the Rust `build.rs` execution mechanism to deliver cross-platform infostealers targeting developer credentials and cryptocurrency wallets.
## Technical Details
- **Type:** Malware family (Infostealer) / Supply Chain Attack
- **Platform:** Windows, Linux, macOS (Intel & Apple Silicon)
- **Capabilities:** Credential theft, crypto-wallet hijacking, persistence, C2 communication.
- **First Seen:** August 20, 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File] (Via `cargo build`)
- **[TA0003 - Persistence]**
- [T1547 - Boot or Logon Autostart Execution]
- **[TA0007 - Discovery]**
- [T1012 - Query Registry]
- [T1082 - System Information Discovery]
- **[TA0009 - Collection]**
- [T1539 - Steal Web Session Cookie]
- [T1555.003 - Credentials from Web Browsers]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Dependency Hijacking:** Injects malicious dependencies into legitimate crates (`arrayref`, `internment`, `append-only-vec`).
- **Build-Time Execution:** Leverages the `build.rs` script in Rust's Cargo build system to execute arbitrary code during compilation.
- **Environment Profiling:** Identifies host OS and CPU architecture to fetch the appropriate second-stage payload.
- **Infostealing:** Targets Chromium-based browsers (Chrome, Brave, Edge) to extract profiles, cookies, and saved credentials.
### Advanced Features
- **Cross-Platform Payloads:** Tailored binaries for Windows, Linux, and both Intel/M-series Macs.
- **Crypto-Wallet Targeting:** Specifically scans for and exfiltrates data from browser extension storage used by cryptocurrency wallets.
- **Registry Manipulation:** Deleting legitimate versions of packages to force users toward poisoned releases.
## Indicators of Compromise
- **File Names:**
- `proc-macro1` (Malicious dependency)
- `build.rs` (Contains the initial stager)
- **Malicious Crates:**
- `arrayref` (v0.3.10)
- `internment` (v0.8.7)
- `append-only-vec` (v0.1.9)
- `proc-macro-en` (All versions)
- `aovine` (All versions)
- `arone` (All versions)
- `aronenao` (All versions)
- `tinymember` (All versions)
- **Network Indicators:**
- [C2/Payload Host - Defanged]: `hxxp[://]attacker-server[.]com/payload` (Placeholder based on description)
- **Behavioral Indicators:**
- Unexpected outbound network connections during `cargo build` or `cargo compile`.
- Creation of persistence keys in Windows Registry or macOS LaunchAgents.
## Associated Threat Actors
- Unknown (Attacker likely compromised a legitimate developer's credentials via account takeover).
## Detection Methods
- **Signature-based detection:** Scan local `Cargo.lock` files and registry caches for the specific malicious crate versions listed above.
- **Behavioral detection:** Monitor for build processes (`cargo`, `rustc`) spawning shells or making network requests to unverified domains.
- **Audit:** Use tools like `cargo-deny` or `cargo-audit` to identify suspicious dependencies or yanked crates.
## Mitigation Strategies
- **Credential Hygiene:** Enable Multi-Factor Authentication (MFA) for all package registry accounts (crates.io).
- **Lockfile Review:** Regularly audit `Cargo.lock` for unexpected changes in the dependency tree, especially "typosquatted" names (e.g., `proc-macro1` vs `proc-macro2`).
- **Network Isolation:** Restrict build server access to the internet; use a local, curated proxy for dependencies.
- **Sandboxing:** Run builds in isolated containers or virtual machines to prevent infostealers from accessing host browser data.
## Related Tools/Techniques
- **Typosquatting:** Creating packages with names similar to popular ones to trick developers.
- **Dependency Confusion:** Exploiting package managers to pull malicious public packages over internal ones.
- **SolarWinds/Codecov Style Attacks:** Prioritizing the compromise of the development pipeline to reach downstream users.