"This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data," security researcher Paul McCarty said.
StubMaker campaign and the 16 typosquatted RubyGems
OpenSourceMalware discovered a Windows-focused typosquatting campaign on August 15, 2026, tracking the activity as StubMaker. The campaign consisted of 16 malicious RubyGems packages that were published and later yanked from RubyGems. The packages identified in the disclosure are:
- ubnuler
- ubnlder
- ri18nr
- reaker
- rakier
- orakw
- joxn
- ise18n
- ioe18n
- ie18u
- iai8n
- i1l8n
- i18om
- activesupmport
- brumdler
- brundlef
The malicious gems were published by two accounts identified as "mod8rz41mje" (aka Riley Miller) and "rbq95bwt6q" (aka Alex Davis). In at least two cases, the packages — brumdler and brundlef — were reclaimed after earlier versions had been removed; the original publisher in those instances was "gemlewqqhu1" (aka Taylor Moore).
How the installer hook and loader chain work
StubMaker abuses Ruby's extconf.rb installation hook to run code automatically when a gem is installed. The malicious extconf.rb fetches a 22 MB Rust-based loader from a GitHub release and uses that loader to launch a Go-based stealer named "wincfg." The GitHub account used to host the release — "github[.]com/bebraz1" — is no longer accessible.
According to McCarty, the malicious gems fake a native build process: they generate a Makefile with empty targets and create stub scripts so the extension phase appears to complete normally while the installer hook does the malicious work. "StubMaker doesn't build anything — it generates a Makefile with empty all, install, and clean targets... so the extension phase reports a clean build while the real work... happens in the installer hook itself," he explained.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat the stealer collects and where data goes
The injected DLL payload — "abe_payload.dll" — is used to extract credentials from Chromium-based browsers by circumventing app-bound encryption protections. The disclosure lists the targeted browsers explicitly: Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG, and CCleaner Browser. In addition to credentials, the stealer gathers extension data, browsing history, payment card numbers, cryptocurrency wallets and seed phrases, Telegram Desktop data, and system information. It also queries "api.ipify[.]org" to obtain the victim's public IP address.
Captured material is packaged into a password-protected ZIP archive, uploaded to Gofile, and the resulting download link is transmitted to the threat actor at "dresslee.com" over an unencrypted HTTP channel.
RubyGems behaviors the attackers exploited
OpenSourceMalware and Jenn Gile highlighted two platform behaviors that made the campaign more effective. First, a namespace can become available for anyone to claim once all versions of a gem have been yanked. That allowed the actor to republish under package names that users might assume were permanently dead. Second, the Author field on a gem is an unvalidated plaintext field that "doesn't have to match the Owner or anything else," Gile told The Hacker News.
Gile said this combination meant that "When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name. What should have been forever dead was revived to compromise more people."
How technologists, maintainers, and end users might respond
Technologists and security teams will watch for installer-phase hooks — specifically extconf.rb behavior that fetches large binaries or launches external loaders — and for packages that claim to build native extensions but only generate stub Makefiles while performing network fetches during installation.
Open-source maintainers will need to monitor name reuse and the risk that a yanked namespace can be reclaimed; the incident shows the author metadata is easily manipulated and should not be treated as provenance. End users and developers should note that the campaign was able to exfiltrate browser and wallet data and that the collected archives were transmitted to a public file-hosting service and signaled to the attacker over unencrypted HTTP.
Related npm findings discovered alongside the disclosure
The disclosure coincided with two supply-chain campaigns targeting npm. SafeDep reported a cluster of 21 npm packages that typosquatted executable names exposed by Google's scoped packages to deliver a minimal postinstall beacon, exploiting the unscoped bin name that any registrant can claim. SafeDep also described a cluster of Baileys npm forks that covertly made an installer's WhatsApp account follow channels the package author controls and injected the author's advertising URL into every image and video the bot sent. SafeDep noted continuous monitoring recorded thousands of package names containing "baileys" and dozens containing "libsignal-node," with malicious behavior observed across many names and versions.
The StubMaker campaign relied on platform behaviors as much as on clumsy typos. The packages have been removed and the hosting account taken down, but the disclosure leaves a concrete choice for platform operators: address namespace reuse and unvalidated metadata, or accept that yanked packages can be resurrected into live threats.
Source: The Hacker News — 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
