AI Weekly Malaysia

Attackers compromised a legitimate Rust crate maintainer's credentials and published poisoned versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) on crates.io, each live for 86-107 minutes before removal. The malicious code hid in a typosquat crate called proc-macro1 (mimicking proc-macro2), using its build.rs script to download OS-specific infostealer payloads during compilation that targeted Chromium-based browser data including Chrome, Brave, and Edge profiles.

Why: If you build Rust projects with Cargo, pin your dependencies to specific versions or use a lockfile and a private registry mirror rather than pulling latest from crates.io in CI. The attack exploited Cargo's automatic execution of build.rs scripts during compilation, meaning any crate in your dependency tree can run arbitrary code on your build machine, not just at runtime. Review whether your CI environment isolates build steps from developer credentials and browser sessions.

A threat actor called 'TheHatman' is selling millions of employee records allegedly exfiltrated from Microsoft Azure environments of nine major companies, including McDonald's (1.7M records), TCS (800K), Vodafone (425K), and HCL (250K). Hudson Rock assessed the data as 'highly likely authentic,' noting it contains phone numbers, physical addresses, job titles, reporting structures, group memberships, and—critically—identities of Global Administrator accounts, making it a phishing and privilege-escalation shortlist.

Why: If you run Azure AD/Entra ID, this illustrates what a directory export actually leaks beyond email: org charts, service account details, and who holds Global Admin. Audit your Entra ID for infostealer-compromised credentials, enforce phishing-resistant MFA on all admin accounts, and review third-party app permissions—Hudson Rock specifically flagged overly permissive third-party apps as a likely vector. The data exposure is severe even without passwords, because knowing your Global Admins by name is enough for targeted attacks.

Microsoft Defender Experts linked 30+ rotating domains to MacSync Stealer, a macOS infostealer that exfiltrates Keychain data, browser credentials, SSH keys, AWS credentials, Kubernetes configs, and Apple Notes. Infection starts via ClickFix social engineering in a zsh Terminal session, followed by curl retrieving payload from attacker-controlled /curl/ paths, with data staged in /tmp/sync* and uploaded via chunked HTTP PUT requests.

Why: Mac-using developers and founders should recognize the ClickFix social-engineering pattern (fake prompts instructing users to paste commands into Terminal) as the entry vector, and should treat unsolicited Terminal/curl instructions with suspicion. The stealer specifically targets AWS credentials, SSH keys, and Kubernetes configs, so anyone developing on macOS should audit whether sensitive credentials are stored in plaintext or browser sessions that this malware is known to collect.