Cybersecurity experts have identified a new typosquatting campaign posing a significant risk to RubyGems users. The campaign, uncovered by OpenSourceMalware on August 15, 2026, involves a Windows-based information stealer that compromises user data.
Discovery and Impact
Dubbed StubMaker, this malicious campaign has been tracked by security researchers and involves a series of packages with deceptive names. These include ‘ubnuler’, ‘ri18nr’, and ‘brumdler’, among others. The campaign aims to extract sensitive information such as browser credentials, cryptocurrency wallets, and Telegram data.
Security researcher Paul McCarty, also known as 6mile, noted that the affected RubyGems packages are poorly disguised typosquats of popular Ruby dependencies. Unlike sophisticated SEO-driven typosquats observed in other threats, these packages are easily identifiable due to their clumsy naming.
Execution and Exploitation
The malicious packages, published by users ‘mod8rz41mje’ and ‘rbq95bwt6q’, exploit a known RubyGems vulnerability. This flaw allows the re-registration of package names once previous versions are removed. Notably, ‘brumdler’ and ‘brundlef’ were originally published by another user before being co-opted by the attackers.
Jenn Gile, co-founder of OpenSourceMalware, highlighted Ruby’s design flaws that facilitate such attacks. The ability to reuse package names and the unregulated ‘Author’ field in RubyGems allowed the attackers to masquerade as different entities while operating under the same account.
Technical Aspects and Broader Implications
The attack employs the ‘extconf.rb’ hook within the Ruby environment, which functions similarly to npm’s lifecycle hooks. This hook triggers the download and execution of a Rust-based loader, which subsequently initiates a Go-based stealer payload. The stealer targets various data sources, including browsers and cryptocurrency wallets, and uploads the harvested data to a remote server.
This incident coincides with other software supply chain threats, such as npm-focused campaigns. These include a set of npm packages that mimic CLI binary names to deliver beacons and Baileys npm forks that engage in malicious activities like hijacking WhatsApp accounts.
Security firm SafeDep has reported that these npm threats exploit gaps in dependency management, underscoring the need for continuous monitoring and improved security practices in software package registries.
As the landscape of software supply chain attacks evolves, vigilance and robust security measures are critical to safeguarding user data and maintaining the integrity of open-source ecosystems.
