StubMaker is a RubyGems supply-chain campaign targeting Windows developer environments through 16 typosquatted malicious Ruby packages. The packages abuse the `extconf.rb` installation hook to fingerprint infected systems and download a Rust-based loader that decrypts and executes an embedded Go-based infostealer in memory.
The infostealer targets Chromium browser credentials and cookies, payment-card information, cryptocurrency wallets and seed phrases, Telegram data, browsing history, and system information. Stolen information is compressed and exfiltrated to attacker-controlled infrastructure.[/subscribe_to_unlock_form]
StubMaker is a RubyGems supply-chain campaign targeting Windows developer environments through 16 typosquatted malicious Ruby packages. The packages abuse the `extconf.rb` installation hook to fingerprint infected systems and download a Rust-based loader that decrypts and executes an embedded Go-based infostealer in memory.
The infostealer targets Chromium browser credentials and cookies, payment-card information, cryptocurrency wallets and seed phrases, Telegram data, browsing history, and system information. Stolen information is compressed and exfiltrated to attacker-controlled infrastructure.[emaillocker id="1283"]
The campaign poses a significant supply-chain risk to developers using RubyGems, as malicious packages can execute during installation and compromise developer workstations. Organizations should remove the affected packages, review systems that installed them, rotate potentially exposed credentials and tokens, and monitor for suspicious Ruby package installation and outbound activity.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial access | T1195.001 | Supply Chain Compromise | Compromise Software Dependencies and Development Tools |
| Initial access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Credential access | T1555.003 | Credentials from Password Stores | Credentials from Web Browsers |
| Collection | T1005 | Data from Local System | - |
| Command and control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | - |
| Exfiltration | T1567.002 | Exfiltration Over Web Service | Exfiltration to Cloud Storage |
The following reports contain further technical details:
[/emaillocker]