Loading story…
Researchers disclosed a RubyGems supply-chain campaign that used 16 typosquatted and republished gems to infect Windows developer systems with the StubMaker information stealer. The operation reportedly exploited RubyGems package-name reuse and an unvalidated author field, letting attackers reclaim abandoned gem names, publish malicious versions, and make related packages appear unrelated. During installation, the malicious gems abused the extconf.rb hook to fingerprint hosts and retrieve a Rust-based loader from GitHub Releases.
The loader then decrypted and launched a Go-based infostealer in memory, enabling largely fileless execution and theft of browser credentials, cookies, payment card data, cryptocurrency wallets and seed phrases, Telegram Desktop data, browsing history, and system information. Stolen data was uploaded to Gofile, and the resulting download link was sent to the attackers over unencrypted HTTP. Reported indicators tied to the campaign include 193.70.34.101 and dresslee.com, along with multiple URLs and SHA-256 hashes published for detection; the malicious packages were later yanked from RubyGems.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
OpenSourceMalware reported that the same threat actor behind the RubyGems StubMaker campaign also ran a typosquatting campaign on npm, using the same command-and-control endpoint, GitHub-hosted Rust loader, and byte-identical Go infostealer. The analysis tied the two ecosystems together through shared infrastructure and matching payload hashes.
OpenSourceMalware discovered a new typosquatting campaign targeting RubyGems users and tracked it as StubMaker. The activity involved 16 malicious gems impersonating popular Ruby dependencies.
Researchers said a second RubyGems account later published 15 additional malicious gems, including a new version of brumdler, bringing the StubMaker campaign to at least 17 malicious gems. The campaign reportedly continued after takedowns by reclaiming yanked gem names through namespace reuse.
The 16 malicious RubyGems packages used in the StubMaker campaign were later removed from RubyGems. Researchers said the attackers had abused package-name reuse and owner changes to republish malicious versions under reclaimed gem names.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
opensourcemalware.com
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourceopensourcemalware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated RubyGems supply-chain attack dubbed **SleeperGem** used malicious releases of `git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab` to target developer workstations. Researchers reported that the attacker appears to have hijacked long-dormant maintainer accounts and pushed trojanized gem versions, including `git_credential_manager` `2.8.0` through `2.8.3`, with code that executed on library load, fetched additional payloads from a fake-looking Git ecosystem repository on `git.disroot.org`, and deliberately avoided running in CI environments to reduce detection. On developer machines, the gems reportedly acted as loaders for a second stage that installed a native daemon, established persistence through **systemd** and **cron**, and attempted privilege escalation via passwordless `sudo` to place a setuid root shell at `/usr/local/sbin/ping6`. Investigators said the malicious releases did not match legitimate source tags and that some affected packages had been inactive for years before suddenly publishing updates, indicating account compromise rather than normal maintenance. Security firms warned that any system that installed or required the affected gems should be treated as fully compromised and that all accessible credentials and secrets should be rotated.
Jul 26, 2026
Attackers are running an SEO-poisoning campaign that impersonates **Gemini CLI** and **Anthropic Claude Code** installation pages to infect Windows developer workstations with a fileless infostealer. The fake sites closely mimic legitimate setup instructions and trick victims into pasting a PowerShell one-liner that installs the real tool while silently executing malicious code in memory. EclecticIQ said the activity was first observed in early March 2026 and linked the Gemini and Claude lures to the same financially motivated actor through shared malware, infrastructure patterns, and social-engineering themes. The malware disables **ETW** logging and bypasses **AMSI**, then steals credentials, session cookies, OAuth tokens, **CI/CD** secrets, VPN details, SSH material, and files from enterprise and collaboration platforms. It also fingerprints hosts, enumerates processes, dumps Windows Credential Manager data, and can receive follow-on remote code execution tasks from command-and-control servers, raising the risk of broader enterprise and software supply-chain compromise from a single infected developer endpoint. Researchers identified more than 30 related malicious domains and a wider impersonation cluster spoofing **Node.js**, **Chocolatey**, **KeePassXC**, and **Monero**, including infrastructure tied to IP `109.107.170.111` hosted by MIRhosting and domains tailored to U.S. and U.K. victims.
Jun 29, 2026
Threat researchers uncovered multiple malware campaigns abusing trusted developer and AI distribution platforms to spread **Rust-based infostealers** through fake or typosquatted repositories. HiddenLayer found that a malicious Hugging Face project, `Open-OSS/privacy-filter`, impersonated OpenAI’s legitimate Privacy Filter repository, briefly became the platform’s top trending project, and was downloaded about **244,000** times before removal. The repository’s `loader.py` fetched a multi-stage payload ending in the `sefirah` infostealer, which harvested browser data, Discord tokens, cryptocurrency wallet data, SSH/FTP/VPN credentials, local files, system details, and screenshots, then exfiltrated the data to `recargapopular[.]com`. Researchers also linked the activity to overlaps with an npm typosquatting campaign associated with the **WinOS 4.0** implant. In a parallel campaign, Netskope reported that attackers impersonated the OpenClaw project with a fake installer site and a typosquatted GitHub organization to deliver a previously undocumented Rust dropper called **Hologram** and a modular implant framework. The malware targeted credentials from more than **250** cryptocurrency wallet, password manager, and 2FA browser extensions, while using anti-sandbox checks, in-memory .NET execution, reflective PE loading, persistence via `Userinit`, COM hijacking, and scheduled tasks, plus direct NT syscall thread injection. Operators staged and relayed infrastructure through legitimate services including **Azure DevOps, Telegram, Hookdeck, snippet.host, and Pastebin**; Netskope said the operation marked the first documented malware abuse of Hookdeck as a C2 relay and later evolved into a third wave, **Pathfinder**, that added confirmed Vidar infostealer delivery.
Jun 29, 2026