Skip to content

StubMaker

Named by 4 kept items in this workspace.

3 items name it under threat actors and 1 under classification.key entities.

Search every workspace for StubMaker. It matches the name as written, so it can find other things that share it.

The items that name it 4

  • The OpenSourceMalware Show #18
    talkas classification.key entities2026-08-21
  • Windows Infostealer Hits npm and Ruby
    writeupas threat actors2026-08-19

    Threat actor/campaign originally discovered on RubyGems, delivering a Windows loader via a fake native-extension install hook that decrypts an embedded Go infostealer entirely in memory; expanded concurrently to npm with 40 packages across five burner accounts. Uses shared C2 infrastructure (193.70.

  • StubMaker RubyGems Campaign Delivers a Windows Infostealer
    writeupas threat actors2026-08-16

    Supply-chain campaign named by the researchers after make_stub/make_stub.bat, fake compiler stand-in artifacts; delivers a multi-stage Windows infostealer via typosquatted RubyGems packages, first identified August 15, 2026

  • OpenSourceMalware Blog
    articleas threat actors2026-07-18

    Campaign originally discovered in Ruby, pushed concurrently to npm; fingerprints victims, downloads a Windows loader, deploys an encrypted Go infostealer.

All threat actors in this workspace.