brida-frida-hooks (RubyGems): malicious gem exfiltrates system data to attacker OASTify server on gem install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
The RubyGems package brida-frida-hooks version 1.0.1 was identified as malware (GHSA-vqw2-j6mj-82hq, MAL-2026-18598, published 2026-11-04). The gem declares an extension script in its gemspec that executes automatically during gem install. The script collects installer identity and local system data — current working directory, home directory, hostname, username, and contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs it over TLS via a raw TCPSocket to a hardcoded Burp Collaborator subdomain (bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com) on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose. Anyone who installed version 1.0.1 had system data exfiltrated. No patched version exists; the package should be treated as compromised and removed.
What to do
- Check whether brida-frida-hooks 1.0.1 was installed on any system; remove it and purge it from Gemfile.lock and caches
- Treat collected data (usernames, hostnames, /etc/passwd, /etc/hosts, DNS config) as exposed and review for follow-on targeting
- Audit systems where the gem was installed for further compromise or persistence
- Block the OASTify callback domain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com at egress
- Prefer pinned, vetted dependencies and scan gemspecs for install-time extension scripts
Sources
All live incidents on Threat Watch
