Researchers found 16 look‑alike (typosquatted) RubyGems packages that trick developers into installing a Windows information stealer. The malicious gems run code automatically during installation, pull down additional malware, and then steal browser logins and crypto wallet data before uploading it to attacker-controlled infrastructure.
Researchers identified 16 typosquatted RubyGems packages designed to look like popular Ruby dependencies. Developers who installed one of these look-alike gems, often due to a simple misspelling, triggered malicious code automatically through Ruby's extconf.rb install hook. This hook acted as a conduit to fetch a 22 MB Rust-based loader from a GitHub release, which in turn launched a Go-based stealer payload on the victim's Windows machine. The stealer harvested browser credentials, cryptocurrency wallet and seed phrase data, and Telegram data, then packaged it into a password-protected ZIP uploaded to Gofile. The resulting download link was sent to the attacker over unencrypted HTTP.
The campaign relied on a combination of naming deception and platform behavior that developers may not fully anticipate. Because gem names were near-matches of well-known dependencies, they were easy to overlook during quick installs. The install-time code execution behavior, similar to lifecycle hooks in other package ecosystems, meant that simply installing a package (not even running it) was enough to trigger compromise. In at least two cases, the attacker also took advantage of a RubyGems platform behavior that makes a namespace available for reclaiming once all versions of a gem have been yanked, allowing a malicious actor to republish under a name that looked familiar and previously legitimate.
Security and engineering teams can reduce exposure by training developers to verify exact package names before installing and treating look-alike names as a high-risk signal. Because install-time execution can run without any additional user action, download and build steps triggered during package installation should be reviewed and monitored. Teams should also add governance checks around package ownership changes and republished or previously yanked names before allowing them into builds. Finally, developers should be reminded that package metadata, including the Author field, is not validated and cannot be used alone to confirm a package's legitimacy.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The malicious behavior triggered automatically during gem installation via Ruby's extconf.rb hook, which pulled a Rust-based loader from a GitHub release that then launched a Go-based stealer payload.
The malware stole browser credentials, cryptocurrency wallets and seed phrases, and Telegram data, then uploaded it as a password-protected ZIP to Gofile.
Yes. RubyGems allows a namespace to be claimed by anyone once all versions of a gem have been yanked, and the threat actor exploited this to republish malicious versions under familiar package names.
No, the Author field is an unvalidated plaintext field that does not have to match the actual package Owner, so it should not be treated as proof of legitimacy.
You typo one gem name, boom, your dev box is leaking browser logins and crypto wallets. These typosquatted RubyGems run extconf dot rb during install, quietly pulling a 22 meg Rust loader from GitHub that launches a Go info stealer. The stealer zips up your browser passwords, seed phrases, and Telegram data, uploads it to Gofile, then sends a plain HTTP link out, no alerts, just gone. Your move: before installing or updating a gem, pause and verify the exact name and owner in RubyGems, if it’s a near‑match or newly owned, don’t ship it.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Attackers used a compromised Rust crate maintainer account to publish new versions that secretly added a typosquatted dependency. That dependency’s build script downloaded and executed malware during compilation, meaning developers could be infected just by building a project. The attacker also…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Attackers are tricking Minecraft players into downloading malware by cloning legitimate mod/client websites and manipulating search results so the malicious pages appear highly ranked. Even after the malware’s command-and-control systems were disrupted, the fake sites and trusted file-hosting links…
