Malicious Rust Crate Delivers OS-Specific Malware to Web3 Developer Systems

Cybersecurity researchers have uncovered a malicious Rust crate, evm-units, that targets Windows, macOS and Linux systems by masquerading as an Ethereum Virtual Machine unit helper tool. Uploaded to crates[.]io in mid-April 2025 by a user named ablerust, it attracted more than 7,000 downloads over eight months, with another package, uniswap-utils, listing evm-units as a dependency and downloaded over 7,400 times before both were removed.

According to Socket security researcher Olivia Brown, the crate downloads a payload tailored to the victim’s OS, writes it to the system temp directory, and silently executes it, returning the Ethereum version number to mislead the user.

The malware explicitly checks for the presence of the qhsafetray.exe process linked to Qihoo 360’s Total Security; if detected, it adjusts its flow, otherwise it decodes a get_evm_version function to fetch a next-stage payload from the external URL download.videotalks[.]xyz and run it.

This cross-platform loader is designed to give attackers full control, with Linux using nohup to run a script in the background, macOS using osascript, and Windows deploying a PowerShell script, wrapped in a VBScript if antivirus is not present.