RubyGems Credential-Stealing Campaign Hits Over 275,000 Downloads

Researchers uncovered a large-scale RubyGems credential-stealing campaign targeting developers with malicious packages disguised as useful automation tools. Attackers achieved over 275,000 downloads since the campaign began in March 2023, exposing thousands of users to serious data theft risks.

Sixty Malicious Gems Discovered

Security researchers identified sixty malicious RubyGems packages uploaded by threat actors using aliases such as zon, nowon, kwonsoonje, and soonje. These packages mimicked legitimate automation utilities for platforms like Instagram, TikTok, Twitter, Telegram, Naver, WordPress, and Kakao. Once installed, they functioned as advertised to avoid suspicion but secretly executed credential-stealing code in the background.

Data Theft Through Embedded Malware

The malicious gems collected sensitive information, including user IDs, passwords, and MAC addresses. Attackers sent this data to their own servers using HTTP POST requests. The packages used Korean-language user interfaces, indicating they targeted individuals or organizations in regions where these platforms are widely used. The design also appears to appeal to marketers or users engaged in bulk account operations, making the malware harder to detect in those circles.

Persistent Threat and Remaining Risks

While many of the malicious gems have been removed from RubyGems, at least sixteen remain active. Even removed packages still pose a danger if developers downloaded and integrated them into projects before deletion. Cached versions or local installations can continue to operate unless manually removed, meaning the risk does not disappear immediately after removal from the repository.

Supply Chain Security Concerns

This incident underscores the vulnerability of software supply chains. Developers who rely on open-source repositories must remain vigilant, as even widely used platforms like RubyGems are not immune to abuse. Unlike other ecosystems with complex dependency trees, RubyGems often encourages direct installation, making targeted malicious packages more likely to spread quickly.

Conclusion

The RubyGems credential-stealing campaign is a stark reminder of the importance of auditing dependencies regularly and removing any suspicious packages. With over 275,000 downloads, the scale of this attack shows how easily malicious code can infiltrate trusted ecosystems. Developers should review recent installations, update security tools, and adopt stricter package verification practices to prevent similar incidents in the future.