- Cybersecurity researchers have discovered a new typosquatting campaign, tracked as StubMaker, targeting RubyGems users with a Windows-based information stealer.
- The 16 malicious gem packages were published by two accounts and have since been yanked; however, threat actors exploited a RubyGems namespace reuse flaw to republish packages.
- The malware targets browser credentials, cryptocurrency wallets, seed phrases, and Telegram data via a multi-stage attack using Rust and Go-based payloads.
Cybersecurity researchers have flagged a new typosquatting campaign, tracked as StubMaker, targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, identified 16 malicious gems published by users “mod8rz41mje” and “rbq95bwt6q.”
“This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data,” security researcher Paul McCarty said. All packages appear to be clumsy typosquats of popular Ruby dependencies.
In at least two cases – brumdler and brundlef – the threat actor exploited a known RubyGems behavior allowing namespace reuse after packages are yanked. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that the campaign became more effective because of Ruby’s “poor design choices” via package name reuse and an unvalidated author field.
“When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name,” Gile said. “What should have been forever dead was revived to compromise more people.”
The attack chain uses an “extconf.rb” hook to trigger execution upon gem installation. This hook acts as a conduit to fetch a 22 MB Rust-based loader from a GitHub release, which then launches a Go-based stealer payload.
The stealer extracts credentials from Chromium-based browsers by circumventing app-bound encryption protections. It also collects cryptocurrency wallets and seed phrases, extracts Telegram Desktop data, and uploads the stolen information to Gofile as a password-protected ZIP archive.
“StubMaker doesn’t build anything — it generates a Makefile with empty targets, plus Unix and Windows stub scripts that do nothing but return success,” McCarty explained. The discovery coincides with two additional software supply chain campaigns targeting npm, including one cluster that typosquatted CLI binary names exposed by Google’s scoped packages.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
