Hackers Abuse Terraform Provider to Steal Developer Credentials and Deploy Backdoors

ThreatLabz reported a campaign that weaponized a trojanized Terraform provider (terraform-provider-awsbeta_v1.0.0) to deploy cross-platform loaders and the FLATROOF Rust backdoor which exfiltrates browser credentials, terminal histories, keychains, and cryptocurrency wallet data; the attack uses covert payloads disguised as .woff font files, multiple C2 channels (Telegram, GitHub, webhooks), platform-specific persistence, and includes IoCs such as file hashes for the malicious provider and the `safari_updater` loader.