Proc-macro1 malicious crate payload
Malware Activity
Summary
Hide ▲
Show ▼
A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and macOS. The payload reconstructed its infrastructure from base64-encoded fragments and chose host-matched code for each platform. It then targeted browser secrets from Chrome, Brave, and Edge while establishing persistence on the endpoint.
Related Happenings
Arrayref maintainer account hit by network compromise
Incident
H score33
First: 20.08.2026 20:53
Last: 20.08.2026 20:53
Sources 1
How related:
Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation.
About this happening:
The arrayref maintainer account was compromised, and malicious crate releases on crates.io executed during compilation on developers’ systems, creating a supply-chain intr...
Arrayref maintainer account hit by network compromise
IncidentHow related: Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation.
About this happening: The arrayref maintainer account was compromised, and malicious crate releases on crates.io executed during compilation on developers’ systems, creating a supply-chain intr...
AmnesiaStealer macOS infostealer distributed via ClickFix
Malware Activity
H score16
First: 14.08.2026 13:45
Last: 14.08.2026 13:45
Sources 1
About this happening:
AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...
AmnesiaStealer macOS infostealer distributed via ClickFix
Malware ActivityAbout this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware Activity
H score37
First: 03.08.2026 21:43
Last: 03.08.2026 21:43
Sources 1
About this happening:
Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
Malicious npm packages delivering a cross-platform RAT to Alibaba developer tools users
Malware ActivityAbout this happening: Researchers uncovered 18 malicious npm packages that deliver a cross-platform RAT through a layered dependency tree, putting Alibaba developer tool users in Chinese-...
BoryptGrab infostealer variant delivered via fake GitHub repositories
Malware Activity
H score30
First: 14.07.2026 22:15
Last: 14.07.2026 22:15
Sources 1
About this happening:
A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...
BoryptGrab infostealer variant delivered via fake GitHub repositories
Malware ActivityAbout this happening: A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...
Malicious npm packages delivering Windows RAT
Malware Activity
H score3
First: 23.06.2026 11:54
Last: 23.06.2026 11:54
Sources 1
About this happening:
A set of malicious npm packages is delivering a Windows-based RAT through a multi-stage install chain, creating risk of credential theft, host profiling, and *...
Malicious npm packages delivering Windows RAT
Malware ActivityAbout this happening: A set of malicious npm packages is delivering a Windows-based RAT through a multi-stage install chain, creating risk of credential theft, host profiling, and *...
Timeline
-
20.08.2026 20:53 2 articles · 1h ago
Proc-macro1 malicious crate payload
Initial DisclosureA typosquatted proc-macro1 dependency shipped a `build.rs` script that executed automatically during compilation and dropped a host-matched payload. The build-time execution converted a routine dependency install into an infostealer delivery event.
Show sources
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53
- Hackers poison arrayref Rust crate to push infostealer malware — www.bleepingcomputer.com — 20.08.2026 20:53