#ParsedReport #CompletenessLow
15-09-2026

New packages identified in GemStuffer 'OpenAI Swarm' malicious RubyGems campaign

https://research.jfrog.com//post/gemstuffer-openai-rubygems/

Report completeness: Low

Actors/Campaigns:
Gemstuffer

Victims:
Rubygems, Local government

Geo:
German

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1059.007, T1071.001, T1074.001, T1119, T1528

IOCs:
File: 8
Coin: 1

Soft:
OpenAI, Claude, unix

Algorithms:
base64, gzip

Functions:
GetMeetings, Image

Languages:
ruby, javascript