Cybersecurity researchers have flagged a new typosquatting campaign targeting **RubyGems** users with a Windows-based information stealer. **OpenSourceMalware**, which discovered the activity on August 15, 2026, is tracking the threat under the moniker **StubMaker**. The complete list of packages published as part of the campaign includes: * ubnuler * ubnlder * ri18nr * reaker * rakier * orakw * joxn * ise18n * ioe18n * ie18u * iai8n * i1l8n * i18om * activesupmport * brumdler * brundlef "This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data," said security researcher **Paul McCarty** (aka **6mile**). "All of the malicious RubyGems packages appear to be typosquats of popular Ruby dependencies, but rather than the clever SEO-fueled typosquats we've seen from other threat actors (e.g., events-channel imitating the popular Node.js events module), they're all clumsy typos." The 16 gems have been published by users named "mod8rz41mje" (aka **Riley Miller**) and "rbq95bwt6q" (aka **Alex Davis**). As of writing, the packages have been yanked from **RubyGems**. ### Exploiting RubyGems' Design In at least two cases – `brumdler` and `brundlef` – the threat actor exploited a known **RubyGems** behavior that makes a namespace available for anyone to claim once all versions of a gem have been yanked. In both instances, the packages were originally published by "gemlewqqhu1" (aka **Taylor Moore**) before being reclaimed by the aforementioned two accounts. **Jenn Gile**, co-founder of **OpenSourceMalware**, noted that while the campaign was disrupted early, its effectiveness was amplified by **Ruby's** "poor design choices" regarding package name reuse and an unvalidated author field. "When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name," Gile explained. "What should have been forever dead was revived to compromise more people."  "The attacker assigned a different 'Author' name for each gem in an attempt to make them look unrelated, even though they all came from the same owner account. This is because the Author field is a totally unvalidated plaintext field. It doesn't have to match the Owner or anything else." ### The Attack Chain The attack chain primarily utilizes an "extconf.rb" hook to trigger execution. Similar to **npm's** lifecycle hooks, "extconf.rb" runs automatically when a user installs a gem. This file is typically used to configure native extensions written in C, C++, or Rust, which are bundled within a Ruby package in the "ext/" directory and compiled during installation. In the case of **StubMaker**, the Ruby hook acts as a conduit to fetch a 22 MB Rust-based loader from a **GitHub** release. This loader then launches a Go-based stealer ("wincfg") payload embedded within it. The **GitHub** account ("github[.]com/bebraz1") associated with the attack is no longer accessible.  ### Data Exfiltration and Evasion Techniques The stealer incorporates a DLL payload ("abe_payload.dll") designed to extract credentials from **Chromium**-based web browsers (including **Google Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Opera GX**, **Vivaldi**, **Yandex**, **Avast**, **AVG**, and **CCleaner Browser**). It achieves this by circumventing app-bound encryption (**ABE**) protections recently added by **Google**. Beyond browser credentials, the malware collects extension data, browsing history, and payment card numbers. It also searches for cryptocurrency wallets and seed phrases, extracts **Telegram Desktop** data, gathers system information, and makes an external request to "api.ipify[.]org" to obtain the victim's public IP address. Once collected, the sensitive data is uploaded to **Gofile** as a password-protected ZIP archive, with the resulting download link sent to the threat actor ("dresslee.com") over an unencrypted HTTP channel. "**StubMaker** doesn't build anything — it generates a Makefile with empty all, install, and clean targets, plus Unix and Windows stub scripts that do nothing but return success, so the extension phase reports a clean build while the real work (the platform beacon, the Windows loader fetch and execution) happens in the installer hook itself," McCarty elaborated. "The name points at that specific move: manufacturing a fake build toolchain to make a malicious install look like a routine one, rather than just describing another typosquatted RubyGems package." ### Broader Supply Chain Concerns This disclosure coincides with the discovery of two additional software supply chain campaigns targeting **npm**: * A cluster of 21 **npm** packages that typosquatted CLI binary names exposed by **Google's** scoped packages to deliver a minimal postinstall beacon. **SafeDep** noted, "The packages did not squat package names. They targeted the bin field, the part of package.json that defines executable command names. Every scoped package that declares a bin entry creates an unscoped name that anyone can register. None of the standard dependency confusion mitigations (scoped publishing, registry allowlists, lockfile pinning) cover this gap." * A cluster of **Baileys npm** forks engaging in various malicious behaviors, including covertly making the installer's **WhatsApp** account follow channels controlled by the package author and injecting the author's advertising URL into every image and video the bot sends. "Continuous monitoring of the **npm** registry records 4,250 package names that contain `baileys` and another 112 that contain `libsignal-node`," **SafeDep** stated, adding that malicious behavior has been observed in 70 package names built on **Baileys** across 343 versions and 15 `libsignal-node` impersonators across 38 versions.