A new software supply-chain attack is targeting Ruby developers through 16 typosquatted RubyGems packages that install a Windows-based information stealer dubbed StubMaker, designed to raid browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.[1][5]
The campaign was identified on August 15, 2026, by researchers from OpenSourceMalware, who reported that the malicious gems masquerade as popular Ruby dependencies with clumsy near-miss names such as ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef, all riffing on legitimate packages like Bundler, i18n, Rake, Active Support, and JSON.[1][5] The rogue gems were published via RubyGems accounts using the handles “mod8rz41mje” (also referred to as Riley Miller) and “rbq95bwt6q” (Alex Davis), which researchers have tied to the StubMaker activity cluster rather than to any known legitimate maintainer.[1]
Once installed on a Windows host, StubMaker executes as a multi-stage stealer that ultimately deploys a DLL payload named abe_payload.dll, which is engineered to bypass Google’s application-bound encryption (ABE) protections and extract secrets from Chromium-based browsers.[1][5] The malware targets saved passwords, cookies, and other stored data from Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast Secure Browser, AVG Secure Browser, and CCleaner Browser, while also searching for locally stored cryptocurrency wallet data, seed phrases, and Telegram artifacts that could enable account takeover or fund theft.[1] Security researcher Paul McCarty, who has been tracking the operation, described StubMaker as a purpose-built stealer for “browser credentials, cryptocurrency wallets, seed phrases, and Telegram data,” underscoring its focus on both financial and messaging platforms.[1][5]
The malware is delivered through RubyGems’ normal installation flow, meaning developers who mistype a dependency name or copy-paste an incorrect reference into their Gemfile or gem install command can unwittingly infect Windows development workstations, CI runners, or build agents that execute the gems’ post-install scripts.[1][5] While public reporting has not yet disclosed reliable download counts for the malicious packages, previous typosquatting incidents on RubyGems and other registries have reached tens or hundreds of thousands of downloads, suggesting that any window between publication and takedown can translate into meaningful exposure for organizations that rely on Ruby in their tooling and pipelines.[7][10]
The StubMaker campaign lands amid broader scrutiny of RubyGems’ security posture, following a July 22, 2026 advisory from the RubyGems team about a CDN caching flaw on RubyGems.org that could have exposed legacy API keys to other users for up to an hour via improperly cached authenticated responses.[2][3] That issue, fixed earlier in July with cache purges and revocation of all legacy API keys, highlighted how repository infrastructure weaknesses and package-level attacks can combine to amplify supply-chain risk for Ruby ecosystems.[2][3]
Defenders are being urged to immediately audit Ruby projects and build environments for any reference to the 16 identified typosquatted gems, remove them where present, and treat affected Windows systems as compromised, with particular attention to browser-saved passwords, reused credentials, cryptocurrency wallets, and Telegram accounts.[1][5] Incident response teams should hunt for artifacts associated with StubMaker, including unusual RubyGems install activity around the suspect package names and Windows binaries or DLLs matching the abe_payload.dll nomenclature, while also deploying endpoint detection and response rules to flag suspicious post-install behavior in Ruby environments.[1][5]
More broadly, organizations relying on Ruby should tighten supply-chain controls by enforcing allow-lists of approved gems, monitoring for newly added dependencies in Gemfile.lock and CI manifests, and integrating static and behavioral analysis of packages before they are allowed into build pipelines.[5][11] Measures such as Ruby’s Bundler “cooldown” feature—which delays resolution of freshly published gems to blunt typosquatting and dependency confusion risks—have recently been expanded in Bundler 4.0.18 and can help reduce the blast radius of malicious uploads when combined with vigilant dependency review and continuous monitoring.[11]
References
- 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
- Single Points of Failure: A Week of Supply Chain Compromises
- Security advisory: Possible leak of legacy API keys via improper …
- Cyware Daily Threat Intelligence – August 17, 2026
- Malicious RubyGems and PyPI Packages Are Stealing Credentials and Crypto: What Happened and How to Protect Yourself
- 60 malicious packages found on RubyGems, downloaded …
- Ruby’s Bundler 4.0.18 Extends Cooldown to bundle lock and bu…
