Rustbot, the macOS malware used in the latest Rust Supply Chain Attack

2026-09-04

Poisoned crates.io releases of arrayref, internment, and append-only-vec pulled in a malicious build-time dependency that fetched an arm64 Mach-O implant during cargo build, harvesting ~/.aws, ~/.ssh, and ~/.kube credentials before its RSA tasking channel was neutered by the private key shipping inside the binary.