Malicious RubyGems Turn Developer Machines Into Monero Miners and Spread Through SSH

Cybersecuritynews •Tushar Subhra Dutta • July 24, 2026

A malicious RubyGems campaign has turned seemingly useful developer packages into tools for hidden cryptocurrency mining. The poisoned packages can consume a machine’s computing power, slow down development work, and quietly generate Monero for the attackers. The campaign also goes beyond a typical package-based infection. One set of malicious gems can examine a compromised developer […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cryptojacking Campaign Exploits RubyGems with 136 Malicious Packages A supply chain attack has compromised RubyGems with 136 malicious packages that deploy an XMRig Monero miner. This attack leverages SSH to propagate itself, affecting developer machines and consuming their computing resources. Researchers documented the campaign on July 22, 2026, revealing systemic vulnerabilities in the Ruby ecosystem. The malicious packages can significantly slow down development work while generating cryptocurrency for the attackers. The incident highlights the need for enhanced security measures in software package management systems. Developers using RubyGems are at risk of having their machines hijacked for cryptomining, leading to potential financial losses and productivity issues. The attack emphasizes the importance of vigilance in reviewing package dependencies and the security of development environments. 2 sources 66

Extracted Entities

Malicious RubyGems Turn Developer Machines Into Monero Miners and Spread Through SSH

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)