16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have uncovered a typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, tracked as StubMaker by OpenSourceMalware, was discovered on August 15, 2026. A total of 16 malicious RubyGems packages were published, all typosquatting popular Ruby dependencies. The packages have since been yanked from RubyGems.

The malicious gems were published by accounts named “mod8rz41mje” (Riley Miller) and “rbq95bwt6q” (Alex Davis). In at least two cases, the threat actor exploited a RubyGems behavior that allows anyone to claim a namespace once all versions of a gem have been yanked. This allowed the attacker to republish malicious versions under previously legitimate package names.

The attack chain uses an “extconf.rb” hook, which runs automatically during gem installation, to fetch a 22 MB Rust-based loader from a GitHub release. The loader then launches a Go-based stealer payload named “wincfg”. The stealer includes a DLL payload (“abe_payload.dll”) that extracts credentials from Chromium-based browsers by circumventing app-bound encryption (ABE) protections. It also collects extension data, browsing history, payment card numbers, cryptocurrency wallets, seed phrases, Telegram Desktop data, and system information. The stolen data is uploaded to Gofile as a password-protected ZIP archive, and the download link is sent to the threat actor over an unencrypted HTTP channel.

Security researcher Paul McCarty noted that the malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data. Jenn Gile, co-founder of OpenSourceMalware, highlighted Ruby’s “poor design choices” regarding package name reuse and an unvalidated author field, which made the campaign more effective despite early disruption.

The disclosure coincides with two other software supply chain campaigns targeting npm: a cluster of 21 npm packages that typosquatted CLI binary names exposed by Google’s scoped packages, and a cluster of Baileys npm forks that engage in malicious behaviors such as covertly making the installer’s WhatsApp account follow channels and injecting advertising URLs into media.