Malicious RubyGems pose as Fastlane to steal Telegram API data
Telegram API queries are redirected to attacker-controlled servers by two malicious RubyGems packages masquerading as well-known Fastlane CI/CD plugins in order to intercept and steal data.
To distribute, install, and manage Ruby libraries (gems), RubyGems is the official package manager for the Ruby programming language. It functions similarly to npm for JavaScript and PyPI for Python.
The packages intercept private information, such as attached files, proxy credentials, chat IDs and message content, and even bot tokens that can be used to take control of Telegram bots.
The supply chain attack was identified by Socket researchers, who issued a report alerting the Ruby development community to the danger read more about Malicious RubyGems pose as Fastlane to steal Telegram API da...