StubMaker

StubMaker is a Windows-focused supply-chain malware campaign and associated malware chain delivered through typosquatted RubyGems packages, and later linked to parallel npm activity by the same threat actor. The operation abused package installation hooks to execute malicious code during dependency installation on developer systems. In the RubyGems variant, malicious extconf.rb hooks fingerprinted the host, generated fake native-extension build artifacts so installation appeared successful, and on Windows downloaded and launched a Rust-based loader. That loader contained an embedded Go information-stealing payload, identified internally as wincfg, which was decrypted and manually mapped entirely in memory for fileless execution.

The malware chain is designed primarily for information theft from Windows hosts. The Go stealer targets Chromium-based browsers and can recover saved passwords, cookies and authenticated sessions, payment-card data, browsing-related data, extension storage, and IndexedDB content. It also targets cryptocurrency wallets and seed phrases, Telegram Desktop data, and general host information such as system characteristics and user context. The stealer includes functionality to bypass Chromium Application-Bound Encryption protections through an embedded DLL used to recover browser decryption material from within browser processes.

Collected data is assembled into a password-protected archive in memory and exfiltrated to attacker-controlled infrastructure. The campaign showed strong operational overlap across ecosystems, with the same loader and embedded stealer used in both RubyGems and npm typosquatting operations. Delivery was tied to malicious package-install hooks rather than conventional phishing, and the targeting pattern indicates a focus on developers and Windows development environments, including cases where Windows payload execution was reached from WSL contexts. No confirmed persistence mechanism has been established from the available facts.