Researchers at OpenSourceMalware have flagged a typosquatting campaign that uses 16 lookalike RubyGems packages to drop a Windows-based information stealer on developers who install them.
The campaign, tracked as StubMaker and discovered on August 15, was disclosed by researcher Paul McCarty. The malicious gems mimic popular Ruby dependencies and harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.
The packages were published by accounts named mod8rz41mje and rbq95bwt6q and have since been yanked. In at least two cases, the actor abused a RubyGems behavior that lets anyone reclaim a namespace once all versions of a gem are removed, reviving dead package names for abuse.
The attack chain runs through an extconf.rb hook that downloads a 22 MB Rust-based loader from a GitHub release. That loader launches a Go-based stealer that extracts credentials from Chromium browsers, collects payment card numbers and browsing history, hunts for wallet files, pulls Telegram Desktop data, and phones home for the victim’s IP address.
Stolen data is packed into a password-protected ZIP, uploaded to Gofile, and the download link is sent to the operator over plain HTTP. The StubMaker name reflects the trick of generating fake build scripts that report a clean install while the payload runs.
Developers should double-check gem names, pin exact versions, and audit extconf.rb hooks before building.
