Malware · Cloud Security · Application Security
Malware found in OVHcloud CLI tool on GitHub steals developer secrets
Attackers slipped info-stealing malware into five OVHcloud CLI releases on GitHub by hijacking a developer account. Anyone who used these versions should change all stored secrets.
Ross GrantUpdated 2 min read
The short version
Attackers broke into a developer's GitHub account and swapped out five versions of the OVHcloud CLI tool with malware. This tool is used by developers and system administrators to manage cloud services. The malware was designed to steal sensitive information stored on users' computers. If you used one of the affected versions, you should change all your passwords and other secrets.
By the numbers
- 5compromised OVHcloud CLI releasesBleepingComputer
- 90 minuteswindow the malicious releases were availableHelp Net Security
- 7 monthsduration the developer's GitHub account was compromisedHelp Net Security
What happened?
Attackers compromised the GitHub account of an OVHcloud developer and replaced five releases of the OVHcloud CLI tool with malware that steals secrets from users' machines. The affected versions (0.11.0 to 0.15.0) were available for about 90 minutes on 19 October 2026 before being blocked. OVHcloud urges anyone who installed these versions to treat all secrets on their machine as compromised.
Who is affected
The incident affects users who downloaded or installed OVHcloud CLI versions 0.11.0 to 0.15.0 from the project's GitHub releases between 14:47 and 16:21 UTC on 19 October 2026. The CLI is a tool used by developers and system administrators to manage OVHcloud services from the command line. Users who built the CLI from source code or used Docker images were not affected. The affected platforms include macOS (Intel and ARM), Linux (x86_64 and ARM64), and Windows x86-64. According to BleepingComputer (opens in a new tab) and Help Net Security (opens in a new tab), anyone who ran an affected binary should treat all secrets on their machine as compromised.
How the attack worked
Attackers hijacked a developer's GitHub account, which had been compromised for about seven months. With this access, they replaced the legitimate release files for five versions of the OVHcloud CLI with malware-infected binaries. The attack did not touch the source code or the project's CI/CD (Continuous Integration/Continuous Deployment) pipelines. Instead, the attackers took advantage of GitHub's release immutability setting being disabled, which allowed them to overwrite existing release assets without triggering automated security checks. The malicious binaries were uploaded directly to GitHub, so anyone who installed the CLI using install scripts, Homebrew, or by downloading tarballs during the affected window received the malware.
What was taken
The malware was designed to steal secrets from the disk. This likely includes credentials, API keys, and other sensitive information stored on the affected machines. OVHcloud's CEO described the malware as "poor quality but it can go all the way," meaning it could still successfully exfiltrate secrets. There is no evidence that the attackers accessed the source repository or CI/CD infrastructure, but any secrets present on machines where the compromised CLI was run should be considered stolen.
The response
OVHcloud detected the compromise after a customer reported suspicious behaviour. The malicious releases were blocked within about 90 minutes of going live. The company enabled GitHub's release immutability feature to prevent similar attacks in the future. OVHcloud urges all users who installed one of the compromised versions to perform a full system cleanup and revoke or rotate all secrets stored on the affected machine. The company considers the incident closed but continues to advise caution for anyone who may have been exposed.
Who is behind it
OpenSourceMalware, a community threat intelligence group, links the attack to the GlassWorm group, which has targeted software development ecosystems since at least 2025. The evidence includes the use of a known GlassWorm wallet and similar tactics in previous attacks. However, this attribution is based on the researchers' analysis and has not been confirmed by law enforcement or OVHcloud.
Claimed vs confirmed
- Unconfirmed
The attack is linked to the GlassWorm group.
OpenSourceMalware researchers attribute the attack to GlassWorm based on indicators, but this is not confirmed by OVHcloud or law enforcement.
Why it matters
This incident shows how attackers can target software supply chains by compromising developer accounts and release processes. Even trusted open-source tools can be tampered with if release controls are weak. Developers and organisations need to review how they manage secrets and verify software downloads.
Key points
- Attackers hijacked a developer's GitHub account to distribute malware.
- Five OVHcloud CLI releases were replaced with info-stealing binaries.
- The attack did not affect source code or CI/CD pipelines.
- Anyone who used the affected versions should change all stored secrets.
- Release immutability was enabled after the incident to prevent future attacks.
Sources
BleepingComputer
Reference
Help Net Security
Reference
