StubMaker RubyGems Campaign Uses Embedded Malware to Steal Credentials and Wallet Data
Summary
StubMaker typosquatted RubyGems packages install a Windows infostealer that embeds later stages, steals browser credentials, wallets, seed phrases and Telegram data, then exfiltrates it.
Key points
- Malicious RubyGems typosquats used an extconf.rb installation hook to send a platform beacon and download a Windows loader; the campaign expanded to 16 gems.
- The Rust loader decrypts an embedded Go infostealer in memory; the Go payload also contains a DLL that targets Chromium App-Bound Encryption keys.
- The malware collects browser passwords, cookies, session tokens, payment-card data, wallet files and seed phrases, Telegram Desktop data, and host information.
- Stolen data is packaged in a password-protected ZIP and uploaded to Gofile; the resulting link and victim summary are sent to dresslee[.]com over HTTP.
- The report found no additional remote payload downloads after the initial loader and no confirmed persistence mechanism.
- The authors recommend investigating RubyGems installation-time network activity, suspicious Downloads/main.exe execution, browser injection, and related collection and exfiltration behavior.
Article Details
- Attack Vectors
- Typosquatted RubyGems packages execute code through an extconf.rb installation hook.
- The installer sends a platform beacon and, on Windows, downloads and executes a Rust loader from a GitHub release.
- The loader decrypts an embedded Go infostealer in memory; the stealer injects an embedded DLL into browser processes to recover Chromium App-Bound Encryption keys.
- The infostealer collects browser credentials, cookies, payment-card data, cryptocurrency wallets and seed phrases, Telegram Desktop data, and host information, then uploads an archive and reports its link.
- Defensive Notes
- Monitor Ruby and RubyGems installation processes for outbound connections during extconf.rb execution, especially requests to the reported beacon endpoint.
- Investigate Ruby writing or executing main.exe from a user's Downloads directory, and look for browser-process injection, elevation-service COM activation, and named-pipe activity.
- Look for rapid access to Chromium profile databases, wallet-extension directories, Telegram tdata, and BIP-39 seed phrases, followed by Gofile uploads and connections to the reported webhook.
- If execution is suspected, isolate the system, revoke browser and Telegram sessions, rotate browser-stored credentials from a clean device, treat saved payment cards as compromised, and move cryptocurrency to newly generated wallets using a trusted device.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dresslee[.]com | Attacker webhook domain receiving the Gofile link and victim summary. |
| IPV4 | 193[.]70[.]34[.]101 | Beacon endpoint contacted by the malicious Ruby installer to report the victim's platform. |
| SHA256 | 1afff50ca4064310d3492c652e1c3168216dcb42063e0b26c223038db46b8731 | SHA-256 hash of the recovered Go infostealer. |
| SHA256 | 2edf1494951ea52eb86c606212668822081b3c589b821e8ec33cde59b65141a7 | SHA-256 hash of the malicious Ruby installation runner. |
| SHA256 | 67719fa6fcaa97936bf678565d6777db5c194e14efeba16864be8dac966e24bc | SHA-256 hash of the recovered embedded ABE helper DLL. |
| SHA256 | 6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d | SHA-256 hash of the downloaded Rust loader, main.exe. |
| SHA256 | a280b369c95b04530af11598f15a58328722af0325509fe1c55028c3fa873111 | SHA-256 hash of a malicious extconf.rb file. |
| URL | hxxp[:]//193[.]70[.]34[.]101:20099/vote | HTTP platform-beacon endpoint used by the malicious Ruby installer. |
| URL | hxxp[:]//dresslee[.]com:20027/xf39jMJ9P1 | Attacker webhook endpoint receiving the Gofile link and victim summary over HTTP. |
| URL | hxxps[:]//github[.]com/bebraz1/qPzM50V1AKG0rVlH/releases/download/null/main.exe | Specific GitHub release URL used to deliver the Windows loader. |
| URL | hxxps[:]//upload[.]gofile[.]io/uploadfile | Upload endpoint used by the infostealer to exfiltrate the password-protected archive. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects browser profile data, wallet files and extension storage, and Telegram Desktop data from the host.T1027 · Obfuscated Files or InformationThe Rust loader and Go stealer are embedded as encrypted data in earlier stages and decrypted in memory.T1055 · Process InjectionThe Go stealer loads its embedded DLL into browser processes to recover Chromium's App-Bound Encryption key.T1082 · System Information DiscoveryThe stealer gathers host information including username, hostname, operating-system details, CPU, GPU, and installed RAM.T1555.003 · Credentials from Web BrowsersThe stealer extracts saved passwords, cookies, and other browser-stored secrets from Chromium-family profiles.T1567.002 · Exfiltration to Cloud StorageThe stealer uploads its archive of stolen data to Gofile.
Malware
Products
Chromiumit from a URL. The stealer, in turn, carries its own embedded DLL for extracting the ABE key that modern Chromium versions use to lock down saved passwords and cookies, so a browser protection meant to survive exactlyMicrosoft WindowsOn August 15, 2026, we discovered newly-published RubyGems packages that installs a multi-stage Windows infostealer malware. This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, andRubyGemsOn August 15, 2026, we discovered newly-published RubyGems packages that installs a multi-stage Windows infostealer malware. This new malware harvests browser credentials, cryptocurrency wallets, seed phrases, andTelegram Desktopstored values, collects extension data, scans for cryptocurrency wallets and seed phrases, extracts Telegram Desktop data, and gathers system information.