Backdoored OVHcloud CLI Releases Targeted Developers’ Secrets
Summary
Attackers compromised OVHcloud’s CLI repository and modified versions 0.11.0–0.15.0 to steal secrets. OVHcloud says the incident is resolved and urges affected users to clean systems and revoke secrets.
Key points
- Attackers reportedly hijacked a developer’s GitHub account to access the OVHcloud CLI repository and modify releases 0.11.0 through 0.15.0.
- OVHcloud said the compromised release appeared on October 19 at 14:47 and was blocked at 16:21 after a customer report.
- Versions 0.10.0 and 0.16.0 were reported clean; source builds and Docker images were unaffected.
- The malware was intended to retrieve secrets from disk. Users who ran an affected binary should treat machine-stored secrets as compromised.
- OVHcloud said its CI/CD pipelines were not impacted, enabled GitHub release immutability, and considers the incident resolved.
- OpenSourceMalware assessed that the attack was likely part of a GlassWorm operation; researchers said they did not analyze the malicious payload.
Article Details
- Victim Organization
- OVHcloud
- Incident Type
- Compromise of the OVHcloud CLI GitHub repository and distribution of trojanized releases containing information-stealing malware.
- Incident Date
- 2026-10-19
- Disclosure Date
- 2026-10-20
- Data Types Exposed
- Secrets stored on affected machines; specific secret types were not disclosed.
- Operational Impact
- CLI versions 0.11.0 through 0.15.0 were compromised and distributed. OVHcloud detected and blocked the compromised release, enabled release immutability, and considered the incident resolved. Source builds and Docker images were unaffected. Users who ran affected binaries were advised to treat their machine-stored secrets as compromised, clean their systems, and revoke or change secrets. No specific number of affected users or confirmed data theft was reported.
- Claim Status
- confirmed