Ethical Hacking News
A recent malicious Rust crate attack has stolen over 8,400 downloads of Solana and Ethereum wallet keys from source code repositories, highlighting the risks associated with software supply chains. Threat actors used typosquatting to masquerade as a legitimate library, posting private wallet keys to a threat actor-controlled C2 endpoint via HTTP POST. This attack demonstrates how minimal code and simple deception can create supply chain risks, emphasizing the need for developers and security teams to prioritize secure software development practices and supply chain security measures.
Researchers at Socket discovered two malicious Rust crates impersonating a legitimate library called fast_log. The malicious crates, faster_log and async_println, were published by threat actors in May 2025 but not detected until September of the same year due to typosquatting. Threat actors used typosquatting to retain the logging functionality of the actual library while introducing malicious code changes during a log packing operation. The attack resulted in the theft of over 8,400 downloads of Solana and Ethereum wallet keys from source code repositories.
THN readers, we have a serious cybersecurity alert for you today. In recent days, researchers at software security company Socket have discovered two malicious Rust crates impersonating a legitimate library called fast_log, which has resulted in the theft of over 8,400 downloads of Solana and Ethereum wallet keys from source code repositories.
The malicious crates, named faster_log and async_println, were published by threat actor under the alias rustguruman and dumbnbased on May 25, 2025. According to security researcher Kirill Boychenko, the two crates "include working logging code for cover and embed routines that scan source files for Solana and Ethereum private keys, then exfiltrate matches via HTTP POST to a hardcoded command and control (C2) endpoint."
The researchers at Socket further revealed that despite being published by the threat actors in May 2025, the crates were not detected until September of the same year. The reason behind this is attributed to typosquatting, which involves the threat actors retaining the logging functionality of the actual library while introducing malicious code changes during a log packing operation.
The malicious code was executed at runtime, when running or testing a project depending on them. According to Crates.io's Walter Pearce, "Notably, they did not execute any malicious code at build time. Except for their malicious payload, these crates copied the source code, features, and documentation of legitimate crates, using a similar name to them."
The use of typosquatting in this attack allowed the threat actors to masquerade as a legitimate library, thereby avoiding detection by casual review. The malicious code then used this familiar design to post private wallet keys to a threat actor-controlled C2 endpoint.
Fortunately for developers and security teams, Socket researchers identified the malicious crates and notified the maintainers of crates.io. Following responsible disclosure, Crates.io took steps to remove the Rust packages and disable the two accounts involved in publishing the malicious crates. Moreover, logs of the threat actors-operated users along with the malicious crates were preserved for further analysis.
The attack highlights how minimal code and simple deception can create supply chain risks. According to security researcher Kirill Boychenko, "This campaign shows how minimal code and simple deception can create a supply chain risk. A functional logger with a familiar name, copied design, and README can pass casual review, while a small routine posts private wallet keys to a threat actor-controlled C2 endpoint. Unfortunately, that is enough to reach developer laptops and CI."
The incident also underscores the importance of secure software development practices and supply chain security measures in protecting sensitive data.
A recent malicious Rust crate attack has stolen over 8,400 downloads of Solana and Ethereum wallet keys from source code repositories, highlighting the risks associated with software supply chains. Threat actors used typosquatting to masquerade as a legitimate library, posting private wallet keys to a threat actor-controlled C2 endpoint via HTTP POST. This attack demonstrates how minimal code and simple deception can create supply chain risks, emphasizing the need for developers and security teams to prioritize secure software development practices and supply chain security measures.
Related Information:
https://www.ethicalhackingnews.com/articles/Malicious-Rust-Crates-Steal-Solana-and-Ethereum-Keys-A-Threat-to-Software-Supply-Chains-ehn.shtml
https://thehackernews.com/2025/09/malicious-rust-crates-steal-solana-and.html
https://socket.dev/blog/two-malicious-rust-crates-impersonate-popular-logger-to-steal-wallet-keys
https://www.mydataremoval.com/blog/what-are-stealer-logs-understanding-the-threat-of-stealer-log-malware/
Published: Thu Sep 25 04:55:37 2025 by llama3.2 3B Q4_K_M
