Actor Profile

StubMaker is a typosquatting campaign tracked by OpenSourceMalware researchers, discovered on August 15, 2026. The campaign operators published 16 malicious RubyGems packages under user accounts "mod8rz41mje" (Riley Miller) and "rbq95bwt6q" (Alex Davis), with some packages reclaimed from previously yanked gems. The threat actor exploited RubyGems' namespace reuse behavior and unvalidated author fields to make packages appear unrelated while operating from the same owner accounts. The campaign's motivation appears to be financially driven, targeting cryptocurrency wallets, seed phrases, and browser credentials. The operators demonstrated knowledge of Ruby package installation hooks and supply chain attack techniques, though their typosquatting approach was described as "clumsy" compared to more sophisticated actors.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages T1195.002 (Compromise Software Supply Chain) through typosquatting popular Ruby dependencies with packages like ubnuler, ri18nr, reaker, and activesupmport. Initial execution occurs via T1059 (Command and Scripting Interpreter) using extconf.rb hooks that trigger automatically during gem installation. The attack chain employs T1105 (Ingress Tool Transfer) to fetch a 22 MB Rust-based loader from GitHub (github[.]com/bebraz1), which deploys a Go-based stealer payload ("wincfg"). The stealer performs T1555.003 (Credentials from Web Browsers) by extracting credentials from Chromium-based browsers using a DLL payload (abe_payload.dll) that bypasses Google's app-bound encryption protections. Additional collection includes T1005 (Data from Local System) targeting cryptocurrency wallets, seed phrases, Telegram Desktop data, browser history, and payment card numbers. The malware performs T1016 (System Network Configuration Discovery) by querying api.ipify[.]org for the victim's public IP. Exfiltration occurs via T1041 (Exfiltration Over C2 Channel) by uploading password-protected ZIP archives to Gofile, with download links sent to dresslee.com over unencrypted HTTP.

Targets & Patterns

The campaign specifically targets software developers in the Ruby ecosystem, particularly those using RubyGems package manager on Windows systems. The typosquatted package names (ubnuler/bundler, ri18nr/i18n, reaker/faker, activesupmport/activesupport, brumdler/bundler) indicate targeting of developers who may mistype popular Ruby dependencies during installation. The Windows-specific information stealer suggests focus on developers using Windows development environments rather than Linux/macOS. The theft of cryptocurrency wallets and seed phrases indicates targeting of developers who hold digital assets, while browser credential harvesting and Telegram data collection suggests broader financial motivation. The campaign exploited developers' trust in the RubyGems ecosystem and reliance on quick package installations without thorough verification. The timing (discovered August 15, 2026) and relatively small package count (16) suggests either an early-stage campaign or targeted testing before broader deployment.

Historical Context

This campaign represents an evolution in supply chain attacks targeting package repositories, building on techniques observed in previous npm and PyPI campaigns. The use of extconf.rb installation hooks parallels npm lifecycle hook abuse seen in other supply chain attacks. The namespace reclamation technique exploited a known RubyGems behavior where yanked package names become available for re-registration, similar to namespace confusion attacks in other ecosystems. The campaign's use of unvalidated author fields to create false attribution diversity echoes tactics from other typosquatting operations. The technical sophistication of bypassing Google's app-bound encryption (ABE) protections indicates the operators incorporated recent browser security research into their tooling. The multi-stage payload delivery (Ruby hook → Rust loader → Go stealer → DLL payload) demonstrates increasing complexity in supply chain malware architecture compared to earlier, simpler campaigns. The concurrent discovery of similar npm campaigns (21 packages targeting Google's scoped packages and Baileys forks) suggests a broader trend of intensified supply chain attacks across multiple package ecosystems during this period.

Defensive Recommendations

  • Monitor RubyGems installations for extconf.rb execution hooks and validate that native extensions are legitimate before compilation; implement allowlisting for packages requiring native compilation (T1195.002)
  • Detect outbound connections to file-sharing services like Gofile during or immediately after package installations; block unencrypted HTTP exfiltration channels to unknown domains (T1041)
  • Deploy browser credential access monitoring to detect unauthorized access to Chromium credential stores and app-bound encryption bypass attempts via suspicious DLL loads (T1555.003)
  • Implement typosquatting detection by maintaining allowlists of approved package names and flagging installation attempts of packages with high string similarity to popular dependencies but from unverified publishers
  • Monitor for ingress tool transfer activity where Ruby processes fetch large executables (>10 MB) from GitHub releases or other code repositories during package installation (T1105)