16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
A typosquatting campaign dubbed "StubMaker" published 16 malicious RubyGems packages on August 15, 2026, designed to steal browser credentials, cryptocurrency wallets, seed phrases, and Telegram data from Windows users The attack exploits RubyGems' `extconf.rb` installation hook to fetch and execute a Rust-based loader from GitHub, which in turn launches a Go-based stealer payload called "wincfg" Threat actors exploited RubyGems' package name reuse policy and unvalidated Author field to reclaim
Analysis
TL;DR
- A typosquatting campaign dubbed "StubMaker" published 16 malicious RubyGems packages on August 15, 2026, designed to steal browser credentials, cryptocurrency wallets, seed phrases, and Telegram data from Windows users
- The attack exploits RubyGems'
extconf.rbinstallation hook to fetch and execute a Rust-based loader from GitHub, which in turn launches a Go-based stealer payload called "wincfg" - Threat actors exploited RubyGems' package name reuse policy and unvalidated Author field to reclaim yanked gems under new accounts, evading detection and prolonging the campaign's effectiveness
- The stealer circumvents Google's App-Bound Encryption (ABE) protections to extract credentials from Chromium-based browsers and exfiltrates data via password-protected ZIP archives uploaded to Gofile
- This campaign coincides with parallel supply chain attacks on npm, including typosquatted CLI binary names and malicious Baileys WhatsApp bot forks, highlighting systemic vulnerabilities across package registries
Why It Matters
This incident exposes critical weaknesses in RubyGems' governance model—specifically package name reuse and unvalidated metadata fields—that threat actors can exploit to sustain long-running supply chain attacks even after initial takedowns. For AI practitioners and developers relying on Ruby ecosystems, it underscores the urgent need for stricter registry security policies, enhanced dependency verification, and awareness that malicious packages can masquerade as legitimate build toolchains.
Technical Details
- Attack Vector: The 16 typosquatted gems (e.g.,
ubnuler,brumdler,activesupmport) mimic popular Ruby dependencies through clumsy character substitutions. They leverage theextconf.rbhook, which runs automatically during gem installation, to execute malicious code under the guise of native extension compilation. - Malware Chain: The
extconf.rbhook fetches a 22 MB Rust-based loader from a GitHub release (account:bebraz1, now inaccessible). This loader embeds and launches a Go-based information stealer ("wincfg") containing a DLL payload (abe_payload.dll) designed to bypass Chromium browser App-Bound Encryption (ABE). - Data Exfiltration: The stealer harvests credentials from 9 Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex, Avast, AVG, CCleaner), cryptocurrency wallets and seed phrases, Telegram Desktop data, browsing history, payment card numbers, and extension data. Collected data is compressed into password-protected ZIP archives and uploaded to Gofile, with download links sent to the attacker's C2 domain (
dresslee.com) over unencrypted HTTP. - RubyGems Exploitation: Attackers exploited two key design flaws: (1) RubyGems allows package namespace reclamation once all versions are yanked, enabling threat actors to republish malicious versions under the same name, and (2) the
Authorfield is an unvalidated plaintext field, allowing attackers to assign different author names per gem to appear unrelated despite sharing the same owner account. - Fake Build Toolchain: StubMaker generates a Makefile with empty
all,install, andcleantargets, plus stub scripts that return success, creating the appearance of a legitimate native extension build while the actual malicious execution occurs entirely within the installer hook.
Industry Insight
- Registry Governance Reform: Package registries (RubyGems, npm, PyPI) must implement immutable package name deletion policies and validate metadata fields to prevent namespace reclamation attacks and author impersonation. The RubyGems design choice allowing name reuse is a systemic vulnerability that demands immediate remediation.
- Supply Chain Monitoring: Organizations should adopt continuous monitoring of dependency registries and enforce lockfile pinning with integrity verification. The parallel npm attacks (21 typosquatted CLI binaries and 70+ malicious Baileys forks) demonstrate that threat actors are actively exploiting similar gaps across ecosystems, making proactive surveillance essential.
- Developer Awareness and Defense: Developers should scrutinize unfamiliar gems, verify package ownership history, and audit
extconf.rbor lifecycle hooks in dependencies. The rise of "clumsy" typosquats suggests attackers are prioritizing volume and speed over sophistication, increasing the likelihood of accidental installation—making automated dependency scanning and least-privilege installation practices critical safeguards.
Disclaimer: The above content is generated by AI and is for reference only.