{"id":2414,"date":"2026-08-18T12:20:46","date_gmt":"2026-08-18T12:20:46","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2414"},"modified":"2026-08-18T12:20:46","modified_gmt":"2026-08-18T12:20:46","slug":"16-typosquatted-rubygems-packages-steal-browser-credentials-and-crypto-wallets","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2414","title":{"rendered":"16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi9BsXf9I7m4IoC0hb3fSwYiBJsaB1_vSj9kGhfi0HsWGeR0xVl_W1O_Z0bd6IxvQ-vUQP5FDsj5mpiwUjv72JG3vNdViDwAKDG1uswOPDfb84xN_n8AgafhIP2sCx8x1Jd4L0mptrXuzCCGze-safV0V13WiWsFbKrKYvIC6CPBncYuhwgaDafyqSJx9Kv\/s1700-e365\/ruby.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer.<\/p>\n<p>OpenSourceMalware, which <a href=\"https:\/\/opensourcemalware.com\/blog\/stubmaker-rubygems-windows-infostealer\" target=\"_blank\">discovered<\/a> the activity on August 15, 2026, is tracking the threat under the moniker <strong>StubMaker<\/strong>. The <a href=\"https:\/\/opensourcemalware.com\/?search=%23stubmaker\" target=\"_blank\">complete list of packages<\/a> published as part of the campaign is below &#8211;<\/p>\n<ul>\n<li>ubnuler<\/li>\n<li>ubnlder<\/li>\n<li>ri18nr<\/li>\n<li>reaker<\/li>\n<li>rakier<\/li>\n<li>orakw<\/li>\n<li>joxn<\/li>\n<li>ise18n<\/li>\n<li>ioe18n<\/li>\n<li>ie18u<\/li>\n<li>iai8n<\/li>\n<li>i1l8n<\/li>\n<li>i18om<\/li>\n<li>activesupmport<\/li>\n<li>brumdler<\/li>\n<li>brundlef<\/li>\n<\/ul>\n<p>\u00abThis new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data,\u00bb security researcher Paul McCarty (aka 6mile) said. \u00abAll of the malicious RubyGems packages appear to be typosquats of popular Ruby dependencies, but rather than the clever SEO-fueled typosquats we&#8217;ve seen from other threat actors (e.g., events-channel imitating the popular Node.js events module), they&#8217;re all clumsy typos.\u00bb<\/p>\n<p>The 16 gems have been published by users named \u00ab<a href=\"https:\/\/rubygems.org\/profiles\/mod8rz41mje\" target=\"_blank\">mod8rz41mje<\/a>\u00bb (aka Riley Miller) and \u00ab<a href=\"https:\/\/rubygems.org\/profiles\/rbq95bwt6q\" target=\"_blank\">rbq95bwt6q<\/a>\u00bb (aka Alex Davis). As of writing, the packages have been yanked from RubyGems.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zero-trust-claude-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8iAp2j8rqTq6aptj6yiYHC-B73UxnWI2NQMt0azp6OVLq9JkO8cpYokLWa8t_IKqrHKPsaM5D_lQ9Ip7kZTi3at4oYfzN1m1b_T4b6MuzBWtmlhdLcQ0nZHicD94rliREFDRewsKBQCTYrAAVNzYKj84_0EZskDUxvkc972s9fYAqcQGEQjVZTc0cr7TB\/s728-e100\/ThreatLocker-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>In at least two cases \u2013 brumdler and brundlef \u2013 the threat actor has been found to take advantage of a known RubyGems behavior that makes a namespace available for anyone to claim once all versions of a gem have been yanked. In both instances, the packages were originally published by \u00abgemlewqqhu1\u00bb (aka Taylor Moore) before they were reclaimed by the aforementioned two accounts. <\/p>\n<p><a name=\"more\"\/><\/p>\n<p>Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that although the campaign was disrupted fairly early, it became more effective because of Ruby&#8217;s \u00abpoor design choices\u00bb via package name reuse and an unvalidated author field.<\/p>\n<p>\u00abWhen one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name,\u00bb Gile said. \u00abWhat should have been forever dead was revived to compromise more people.\u00bb<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgM4iiHHG2JIYuXsQ-KejNjlvLkAT5mfeZImAWK8CY642m5V3Yjsjq8tyPj3TmV2QydmKtbBYRC8-UDQeTNPiMwrz2SrBpooFAQS0D6gBdBeIp3A0nqNqlRoqQKEUAQ_Muc8QfpfQtVD44TfP-uPBiXf2OqZBCmPahA1Hg5XbyeMJ5qJ89ML-hPuMWGzZpG\/s1700-e365\/table.jpeg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgM4iiHHG2JIYuXsQ-KejNjlvLkAT5mfeZImAWK8CY642m5V3Yjsjq8tyPj3TmV2QydmKtbBYRC8-UDQeTNPiMwrz2SrBpooFAQS0D6gBdBeIp3A0nqNqlRoqQKEUAQ_Muc8QfpfQtVD44TfP-uPBiXf2OqZBCmPahA1Hg5XbyeMJ5qJ89ML-hPuMWGzZpG\/s1700-e365\/table.jpeg\" alt=\"\" border=\"0\" data-original-height=\"768\" data-original-width=\"1408\"\/><\/a><\/div>\n<p>\u00abThe attacker assigned a different &#8216;Author&#8217; name for each gem in an attempt to make them look unrelated, even though they all came from the same owner account. This is because the Author field is a totally unvalidated plaintext field. It doesn&#8217;t have to match the Owner or anything else.\u00bb<\/p>\n<p>The attack chain, at a high level, makes use of an \u00abextconf.rb\u00bb hook to trigger the execution hook. Similar to <a href=\"https:\/\/docs.npmjs.com\/cli\/v8\/using-npm\/scripts\" target=\"_blank\">npm&#8217;s lifecycle hooks<\/a>, \u00abextconf.rb\u00bb is <a href=\"https:\/\/guides.rubygems.org\/gems-with-extensions\/\" target=\"_blank\">run automatically<\/a> when a user installs a gem. The file is typically used to configure native extensions written in C, C++, or Rust that are bundled inside a Ruby package within the \u00abext\/\u00bb directory and compiled during installation of the gem.<\/p>\n<p>In the case of StubMaker, the Ruby hook acts as a conduit to fetch a 22 MB Rust-based loader from a GitHub release, which, in turn, launches a Go-based stealer (\u00abwincfg\u00bb) payload embedded into it. The GitHub account (\u00abgithub[.]com\/bebraz1\u00bb) is no longer accessible.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgRw-VPAjgsGgx3eKz3zakFKegvv_CfSO4I_nxIFlpu7wYV3HTFQ94ZXl1HEdp2iaK9LcVB9VLwpnS1PiIVkZwp29U7Tuc7DQSnGyehvg_GBi_7lcTWuspvbU9aFU7v74eLDBiVoJRbrm5v-R1R5h4kiYGkdhiy3c7EfJQr6rDPTq7_-YJ8pOjKuHUt3PVs\/s1700-e365\/193.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgRw-VPAjgsGgx3eKz3zakFKegvv_CfSO4I_nxIFlpu7wYV3HTFQ94ZXl1HEdp2iaK9LcVB9VLwpnS1PiIVkZwp29U7Tuc7DQSnGyehvg_GBi_7lcTWuspvbU9aFU7v74eLDBiVoJRbrm5v-R1R5h4kiYGkdhiy3c7EfJQr6rDPTq7_-YJ8pOjKuHUt3PVs\/s1700-e365\/193.png\" alt=\"\" border=\"0\" data-original-height=\"747\" data-original-width=\"1730\"\/><\/a><\/div>\n<p>The stealer, for its part, incorporates a DLL payload (\u00ababe_payload.dll\u00bb) that&#8217;s used to extract credentials from Chromium-based web browsers (i.e., Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG, and CCleaner Browser) by circumventing app-bound encryption (ABE) protections added by Google.<\/p>\n<p>It also collects extension data, browsing history, and payment card numbers; searches for cryptocurrency wallets and seed phrases; extracts Telegram Desktop data; gathers system information; and makes an external request to \u00abapi.ipify[.]org\u00bb to obtain the victim&#8217;s public IP address.<\/p>\n<p>Once the relevant data is captured, it&#8217;s uploaded to Gofile in the form of a password-protected ZIP archive and the resulting download link is sent to the threat actor (\u00abdresslee.com\u00bb) over an unencrypted HTTP channel.<\/p>\n<p>\u00abStubMaker doesn&#8217;t build anything \u2014 it generates a Makefile with empty all, install, and clean targets, plus Unix and Windows stub scripts that do nothing but return success, so the extension phase reports a clean build while the real work (the platform beacon, the Windows loader fetch and execution) happens in the installer hook itself,\u00bb McCarty explained.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abThe name points at that specific move: manufacturing a fake build toolchain to make a malicious install look like a routine one, rather than just describing another typosquatted RubyGems package.\u00bb<\/p>\n<p>The disclosure coincides with the discovery of two software supply chain campaigns targeting npm &#8211;<\/p>\n<ul>\n<li>A <a href=\"https:\/\/safedep.io\/google-dep-confusion-bin-harvesting\/\" target=\"_blank\">cluster of 21 npm packages<\/a> that typosquatted CLI binary names exposed by Google&#8217;s scoped packages to deliver a minimal postinstall beacon. \u00abThe packages did not squat package names,\u00bb SafeDep said. \u00abThey targeted the bin field, the part of package.json that defines executable command names. Every scoped package that declares a bin entry creates an unscoped name that anyone can register. None of the standard dependency confusion mitigations (scoped publishing, registry allowlists, lockfile pinning) cover this gap.\u00bb<\/li>\n<\/ul>\n<ul>\n<li>A <a href=\"https:\/\/safedep.io\/malicious-baileys-npm-whatsapp-campaign\/\" target=\"_blank\">cluster of Baileys npm forks<\/a> that engage in a variety of malicious behaviors: covertly make the installer&#8217;s WhatsApp account follow channels the package author controls and inject the author&#8217;s advertising URL into every image and video the bot sends.<\/li>\n<\/ul>\n<p>\u00abContinuous monitoring of the npm registry records 4,250 package names that contain baileys and another 112 that contain libsignal-node,\u00bb SafeDep said, adding the malicious behavior has been observed in 70 package names built on Baileys across 343 versions and 15 libsignal-node impersonators across 38 versions.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2415,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[265,446,143,35,1633,571,3059,617],"class_list":["post-2414","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-browser","tag-credentials","tag-crypto","tag-packages","tag-rubygems","tag-steal","tag-typosquatted","tag-wallets"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2414"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2414\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2415"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}