StubMaker campaign used 16 typosquatted RubyGems to steal data
OpenSourceMalware has identified 16 typosquatted RubyGems packages used to distribute a Windows information stealer dubbed StubMaker. The campaign, discovered on August 15, 2026, targeted developers and other RubyGems users through packages resembling popular Ruby dependencies. The gems have since been yanked from the registry.
Security researcher Paul McCarty said the malware collected browser credentials, cryptocurrency wallets and seed phrases, and Telegram data. The malicious packages included ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler and brundlef.
Installer hook concealed the payload delivery
The attack relied on an extconf.rb hook, which RubyGems runs automatically during gem installation. This mechanism normally configures native extensions within a package’s ext/ directory before compilation. In this campaign, it instead fetched a 22 MB Rust-based loader from a GitHub release and used it to launch a Go-based stealer called wincfg.
McCarty said StubMaker generated a Makefile with empty build targets and Unix and Windows scripts that simply returned success. The extension stage therefore appeared to complete normally, while the installer hook handled platform checks, retrieval of the Windows loader and execution.
The GitHub account used for the loader, bebraz1, is no longer accessible. The campaign shows why package installation must be treated as code execution: dependency review cannot stop at application source files when install-time hooks can retrieve and run additional payloads.
Browser and wallet data were primary targets
The stealer contained a DLL named abe_payload.dll that extracted credentials from Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG and CCleaner Browser. It was designed to circumvent Google’s app-bound encryption protections and also gathered extension data, browsing history, payment card numbers, system information and the victim’s public IP address through api.ipify.org.
It also searched for cryptocurrency wallets and seed phrases and extracted Telegram Desktop data. Captured information was uploaded to Gofile in a password-protected ZIP archive; the resulting download link was sent to the operator’s dresslee.com domain over unencrypted HTTP.
Registry design expanded the exposure
The 16 gems were published by accounts named mod8rz41mje and rbq95bwt6q. In the cases of brumdler and brundlef, the actors exploited RubyGems behaviour that permits a namespace to be claimed after all versions of a gem are yanked. Those names had first been published by another account before being reclaimed by the two malicious accounts.
OpenSourceMalware co-founder Jenn Gile said an unvalidated author field also helped make related packages appear independent. This supply-chain pattern fits alongside npm supply-chain attack patterns because registry names, installation behaviour and package metadata can all become routes for malicious code to reach developer environments.
For businesses, the practical response is to validate package names and ownership before adoption, pin and review dependencies, and monitor installation hooks and outbound network activity from build and developer systems.