136 Malicious RubyGems Packages Deploy XMRig Miner and Spread via SSH

Gbhackers •Mayura Kathir • July 24, 2026

A large-scale supply chain attack has flooded RubyGems with 136 trojanized packages that deploy an XMRig Monero miner and self-propagate via SSH, underscoring systemic weaknesses in language ecosystems beyond npm and PyPI. On July 22, 2026, researchers Moe Ghasemisharif, Ruian Duan, Zhanhao Chen, and Daiping Liu documented a coordinated cryptojacking campaign abusing RubyGems as the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cryptojacking Campaign Exploits RubyGems with 136 Malicious Packages A supply chain attack has compromised RubyGems with 136 malicious packages that deploy an XMRig Monero miner. This attack leverages SSH to propagate itself, affecting developer machines and consuming their computing resources. Researchers documented the campaign on July 22, 2026, revealing systemic vulnerabilities in the Ruby ecosystem. The malicious packages can significantly slow down development work while generating cryptocurrency for the attackers. The incident highlights the need for enhanced security measures in software package management systems. Developers using RubyGems are at risk of having their machines hijacked for cryptomining, leading to potential financial losses and productivity issues. The attack emphasizes the importance of vigilance in reviewing package dependencies and the security of development environments. 2 sources 66

Extracted Entities

136 Malicious RubyGems Packages Deploy XMRig Miner and Spread via SSH

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)