RubyGems webhook registration used for chunked data exfiltration

Ankit Mehta@Secvyn

•updated 6 days ago•0•0•0

Detects anomalous POST requests to the RubyGems webhook API endpoint (/api/v1/web_hooks) containing specific indicators ('A000' or 'ZZEND') in the request body, which suggests the misuse of legitimate webhooks for chunked data exfiltration.