← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign
WHITE CyberHunter_NL 2025-08-08 Modified: 2025-08-08
6
IOCs
LOW VOLUME
aliascompromisegemsmalicious gemsiocszon aliasc2 endpointsemail addressesextractedgems mymin26telegramcapture
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (6)
All URL domain email
TYPEINDICATORDESCRIPTIONCREATED
URL http://appspace.kr/bbs/login_check.php — 2025-08-08
URL http://programzon.com/auth/program/signin — 2025-08-08
domain appspace.kr — 2025-08-08
domain duopro.co.kr — 2025-08-08
domain programzon.com — 2025-08-08
email marketingduo@marketingduo.com — 2025-08-08
References (1)
↗ https://socket.dev/blog/60-malicious-ruby-gems-used-in-targeted-credential-theft-campaign