Cybersecurity researchers have uncovered a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The activity was discovered by OpenSourceMalware on August 15, 2026, and has been tracked as StubMaker. The campaign involved 16 malicious RubyGems packages designed to look like popular Ruby dependencies. Researchers said the packages were created with small spelling mistakes, increasing the risk that developers could install them by accident while searching for legitimate libraries.
The 16 packages identified in the campaign are ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef. According to researchers, the packages were published by accounts named mod8rz41mje, also known as Riley Miller, and rbq95bwt6q, also known as Alex Davis. The malicious gems have since been yanked from RubyGems, reducing the immediate risk of further installations. Researchers emphasized that these names closely resemble expected dependencies, making simple spelling errors a practical way for attackers to reach developers.
The malware behind the campaign is designed to steal sensitive information from Windows systems. Researchers said StubMaker can collect browser credentials, cryptocurrency wallet information, seed phrases, Telegram Desktop data, browsing history, payment card numbers, browser extension information, and system details. It also contacts api.ipify.org to determine the victim’s public IP address. This means a developer who installs one of the malicious gems could expose both account credentials and valuable financial information.
The attack begins through the extconf.rb installation hook, which can run automatically when a Ruby gem is installed. In this campaign, the Ruby-based hook acts as a delivery mechanism and downloads a 22 MB Rust-based loader from a GitHub release. That loader then launches a Go-based information stealer called wincfg. Researchers said the GitHub account used to host the loader, github.com/bebraz1, is no longer accessible, but the infection chain shows how package installation can be abused.
The stealer specifically targets Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG, and CCleaner Browser. Its DLL component, named abe_payload.dll, is used to extract credentials while bypassing Google’s App-Bound Encryption protections. Beyond passwords, the malware searches for browser data, cryptocurrency wallets, and seed phrases. This makes the campaign particularly concerning for developers who store sensitive accounts or digital assets on their workstations.
Researchers also found a weakness involving RubyGems package-name reuse. In the cases of brumdler and brundlef, the attackers were able to reclaim package names after all previous versions had been yanked. The packages had originally been published by another account before being taken over and republished by the malicious accounts. OpenSourceMalware said this behavior can allow a package that should have been permanently inactive to become available again under a new owner.
Another issue identified by researchers involves the Author field used by RubyGems packages. The field is an unvalidated text value and does not have to match the package owner, allowing the same attacker to make related malicious gems appear to have different authors. The malware also creates fake build components so the installation can appear normal. Researchers said the real malicious activity takes place through the installer hook while the build process itself can appear successful.
The campaign highlights the security risks developers face when relying on public package repositories and copying dependency names without checking them carefully. Typosquatting works because a single missing, added, or changed character can make a malicious package look similar to a trusted one. Although the 16 identified gems have been removed from RubyGems, developers should review dependency files for unexpected packages and carefully verify dependencies before installing them.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
