16 Typosquatted Ruby Gems Packages Steal Browser Credentials and Crypto Wallets
Summary: OpenSourceMalware discovered on August 15, 2026, a typosquatting campaign it calls StubMaker that published 16 malicious RubyGems packages from accounts 'mod8rz41mje' and 'rbq95bwt6q', using an extconf.rb install hook to fetch a 22 MB Rust loader from GitHub that launches a Go-based stealer named wincfg. The stealer uses abe_payload.dll to bypass Google's app-bound encryption and harvest credentials from Chromium-based browsers, cryptocurrency wallets and seed phrases, Telegram Desktop data, browsing history and payment card numbers, uploading them as a password-protected ZIP to Gofile with the link sent to dresslee.com over unencrypted HTTP.
Key Takeaway: The same actor ran a parallel npm campaign of 37 typosquatted packages sharing one payload and one command-and-control backend, and RubyGems let a yanked package name be reclaimed by a new owner account, so what should have been dead was revived to compromise more people.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026