#ParsedReport #CompletenessMedium
05-10-2026

Malicious Crypto Shell Packages Target RubyGems

https://opensourcemalware.com/blog/malicious-crypto-shell

Report completeness: Medium

Threats:
Typosquatting_technique
Clipboard_hijacking_technique

Victims:
Cryptocurrency developers, Web3 developers, Cryptocurrency exchanges, Wallet users

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1027, T1036, T1041, T1059.004, T1071.001, T1083, T1090, T1105, T1115, have more...

IOCs:
IP: 2
File: 9
Url: 3
Coin: 4
Hash: 6

Soft:
curl, Chrome

Wallets:
tron, tronlink, metamask, coinbase, exodus_wallet, electrum, bybit

Crypto:
bitcoin, ethereum, solana, binance, kucoin

Algorithms:
base64, sha256

Languages:
ruby, javascript, python

Links:
https://github.com/makevoid/ethereum.rb