Five Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
2026-03-11T07:24:08Z•e7e9127c03169d42754d1345822b3d4aeb0a8940ddbef7b308fab05da3c50702
.envAI-assisted-malwareAPT28AsusAuraInspectorCI/CDCISA-KEVChrome-extension-compromiseFortiGateGoogle-Looker-StudioKadNapLeakyLookerSalesforce-Experience-CloudUNC4899active-exploitationcrates.iocredentials-theftfirewall-exploitationmacOS-RATmalicious-rust-cratesmass-scannpm-malwarerouter-botnetsecret-exfiltrationsupply-chain
What happened
The collection highlights multiple active threats and supply-chain risks: five malicious Rust crates on crates.io exfiltrate .env secrets from CI/CD pipelines; a campaign abusing FortiGate NGFWs (via recent vulnerabilities or weak creds) to steal service-account credentials; KadNap malware has enlisted 14,000+ Asus routers into a stealth proxy botnet; and a malicious npm package posing as an OpenClaw installer deploys a RAT to steal macOS credentials. Additional coverage includes LeakyLooker cross-tenant SQL flaws in Google Looker Studio, Chrome extensions turned malicious after ownership hand
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- e7e9127c03169d42754d1345822b3d4aeb0a8940ddbef7b308fab05da3c50702
- Enrichment time
- 2026-03-11T07:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.