Malicious Rust crates basek & hesk on crates.io — keyloggers/wallet stealers exfiltrating via Telegram Bot API
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
Two malicious Rust crates published on crates.io, basek 0.1.0 and hesk 0.1.0, were identified and published to the GitHub Advisory Database on 2026-11-13. basek is a Windows keylogger: its getdata() routine captures keystrokes, batches them with the local username, and exfiltrates via the Telegram Bot API (XOR-obfuscated bot token, hardcoded chatid 7304091279) plus a secondary endpoint keylogger.nullsect0r.tech; it installs to %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, adds an HKCU Run key, spawns a watchdog clone, and self-deletes, with sleep/warmup/jitter anti-sandbox tricks. hesk contains async payloads (dat, bs) that walk the home directory, zip wallet artefacts (e.g. exodus.wallet), and upload them via Telegram, padded with ~100 filler functions for camouflage; its dependencies add keylogging and Windows persistence capability. Both use 'educational project' framing. No fixed versions exist; the crates should be treated as fully malicious.
What to do
- Immediately check lockfiles and dependency trees for basek or hesk and remove them; treat any build that included them as compromised
- If installed on Windows hosts, hunt for %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value 'WinSysUtils', random 12-digit-named watchdog processes, and outbound traffic to api.telegram.org and keylogger.nullsect0r.tech
- Assume keystrokes and credentials typed on affected machines were captured; rotate passwords, tokens, and keys, prioritising wallet/exchange credentials
- Check for missing or exfiltrated crypto wallet files (e.g. exodus.wallet) and move remaining assets to new wallets/seed phrases
- Block network indicators (api.telegram.org bot endpoints used, keylogger.nullsect0r.tech) and review egress logs for prior exfiltration
- Rebuild affected systems from clean images rather than attempting in-place cleanup
Sources
All live incidents on Threat Watch
