Threats Tagged 'mastra campaign'

On August 20, 2026, malicious versions of three Rust crates ([email protected], [email protected], and [email protected]) were published to crates.io. These crates included a typosquatted dependency (proc-macro1) whose build script downloads and executes a remote binary at compile time. The payload is a backdoor that communicates with command and control servers via HTTPS, exfiltrates host information, enumerates installed applications, reads browser profiles for saved logins, and persists through various mechanisms such as Registry Run keys, LaunchAgent, or systemd user services. The campaign infrastructure overlaps with known North Korean threat actor operations, including shared C2 endpoint patterns with the Mastra campaign and IP addresses linked to the axios npm attack.