Full Report
Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn
Analysis Summary
# Tool/Technique: StubMaker
## Overview
StubMaker is a malicious campaign targeting the RubyGems ecosystem through typosquatting. It utilizes a multi-stage infection chain to deliver a Windows-based information stealer designed to exfiltrate browser credentials, cryptocurrency data, and personal communications. The campaign is notable for its use of "extconf.rb" hooks to automate malware delivery during the package installation process.
## Technical Details
- **Type:** Malware Family (Information Stealer)
- **Platform:** Windows
- **Capabilities:** Credential theft, cryptocurrency wallet hijacking, data exfiltration, bypassing Chrome App-Bound Encryption (ABE).
- **First Seen:** August 15, 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0002 - Execution]**
- [T1059.006 - Command and Scripting Interpreter: Python/Ruby]
- **[TA0005 - Defense Evasion]**
- [T1553.005 - Subvert Trust Controls: Install Root Certificate (Related to ABE bypass mechanisms)]
- [T1027 - Obfuscated Files or Information]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage]
## Functionality
### Core Capabilities
- **Browser Harvesting:** Extracts saved passwords, cookies, credit card numbers, and browsing history from Chromium-based browsers.
- **Crypto-Stealing:** Scans for local cryptocurrency wallet files and mnemonic seed phrases.
- **Communication Theft:** Targets Telegram Desktop data to hijack user sessions and messages.
- **System Reconnaissance:** Collects hardware information and determines the victim's public IP address via `api.ipify.org`.
### Advanced Features
- **App-Bound Encryption (ABE) Bypass:** Utilizes a specific DLL (`abe_payload.dll`) to circumvent Google Chrome's security features that protect cookies and passwords.
- **Fake Build Chain:** Generates a dummy Makefile with empty targets to fool the RubyGems installer into reporting a "clean build" while the malicious payload executes in the background.
- **Multi-Language Architecture:** Employs a Ruby-based initial hook, a Rust-based loader, a Go-based stealer payload, and a C++ (DLL) component for credential extraction.
## Indicators of Compromise
- **File Names:**
- `wincfg` (Go-based stealer)
- `abe_payload.dll`
- `extconf.rb` (Malicious version)
- **Network Indicators:**
- `github[.]com/bebraz1` (Source of Rust loader)
- `dresslee[.]com` (C2/Exfiltration reporting)
- `gofile[.]io` (Destination for exfiltrated ZIP archives)
- `api[.]ipify[.]org` (IP discovery)
- **Malicious RubyGems:** `ubnuler`, `ubnlder`, `ri18nr`, `reaker`, `rakier`, `orakw`, `joxn`, `ise18n`, `ioe18n`, `ie18u`, `iai8n`, `i1l8n`, `i18om`, `activesupmport`, `brumdler`, `brundlef`.
## Associated Threat Actors
- Tracked under the moniker **StubMaker**.
- Linked to RubyGems profiles: `mod8rz41mje` (Riley Miller), `rbq95bwt6q` (Alex Davis), and `gemlewqqhu1` (Taylor Moore).
## Detection Methods
- **Behavioral Detection:** Monitor for Ruby processes (`ruby.exe`) spawning network connections to GitHub or file-sharing sites during package installation.
- **Signature-based:** Scanning for the "extconf.rb" hook pattern that executes external binaries instead of standard C-extension compilation.
- **File Monitoring:** Watch for the creation of unauthorized ZIP files in temporary directories containing browser profile data.
## Mitigation Strategies
- **Dependency Pinning:** Use `Gemfile.lock` to ensure only verified versions of gems are installed.
- **Name Verification:** Carefully inspect gem names for "clumsy" typos before installation (e.g., checking `brundlef` vs `bundler`).
- **Network Egress Filtering:** Block outbound connections from development environments to unauthorized file-sharing domains like Gofile.
- **Environment Isolation:** Conduct package installations within containers or sandboxed environments to prevent local credential theft.
## Related Tools/Techniques
- **Typosquatting:** Similar to attacks seen in NPM and PyPI.
- **Lifecycle Hooks:** Abuse of automated configuration scripts (similar to `preinstall` scripts in Node.js).
- **LUMMA / RedLine:** Functionally similar to other modern Windows-based information stealers.