Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
OVHcloud CLI supply chain attack: learn how hackers distributed secret-stealing malware and how to improve software supply chain security.
Attackers compromised five OVHcloud CLI releases by hijacking a contributor's GitHub account and replacing download archives with malicious builds designed to steal secrets. The incident highlights software supply chain risks and the importance of verified releases, protected developer accounts, and secure credential management.
Key takeaways
- Attackers compromised five OVHcloud CLI releases through a hijacked contributor account.
- The affected versions were v0.11.0 through v0.15.0.
- Modified archives and checksum files weakened software integrity verification.
- Users who ran potentially compromised binaries should rotate accessible secrets.
- Verified releases, immutable assets, protected accounts, and secure CI/CD practices help reduce supply chain risks.
Introduction
Software supply chain attacks continue to threaten organizations by targeting trusted development tools and distribution channels. In an incident reported on October 19, 2026, attackers hijacked a contributor's GitHub account and replaced download archives for five releases of the OVHcloud command-line interface (CLI) with malicious versions designed to steal secrets from affected machines.
The incident highlights how compromised developer accounts and insufficient release protections can turn legitimate software updates into a potential security risk.
For the incident details and recommended precautions, consult the official OVHcloud security advisory: blog.ovhcloud.com.
Users and organizations relying on OVHcloud CLI should verify their installed versions and review the recommended security measures.
How the OVHcloud CLI Attack Happened
According to OVHcloud, the altered archives were available on GitHub for approximately 94 minutes, between 12:47 and 14:21 UTC. The affected releases were versions v0.11.0 through v0.15.0, originally published between April and September 2026.
The malicious files targeted macOS, Linux on x86-64 and ARM64, and Windows on x86-64. The attacker replaced selected downloadable archives and modified the associated checksum file, allowing the published hashes to match the altered binaries.
Importantly, OVHcloud reported that its source code, release tags, and build pipeline were not compromised. Instead, the attacker uploaded a separate build directly to existing GitHub releases using a hijacked contributor account.
Users who installed or upgraded the CLI during the exposure window through affected download paths were potentially at risk. Installations through Homebrew were protected by pinned SHA-256 checksums, while source builds and the previously published Docker image were not identified as affected.
Why the Attack Is Significant
The incident demonstrates that protecting source code alone is not enough. If attackers gain access to a trusted contributor account and can modify existing release assets, users may download malicious software from an otherwise legitimate repository.
The attack also exposed weaknesses in software integrity verification. The official installation script and certain upgrade paths did not verify downloaded archives against trusted hashes. Consequently, replacing the archive and its checksum file could undermine the integrity checks available to users.
Investigators have also raised a possible connection between the compromised account and the GlassWorm malware campaign. However, this remains an investigative inference, and the malicious October binary has not been publicly linked to GlassWorm.
What Users Should Do
OVHcloud published a clean v0.16.0 release with immutable release protections enabled. Organizations should take the following precautions:
Rotate exposed secrets: Anyone who ran a potentially compromised binary should treat secrets readable from that machine as exposed. Rotate API credentials, tokens, and other sensitive keys from a separate, trusted device.
Replace affected software: Remove the suspicious binary and install the verified v0.16.0 release.
Verify release integrity: Use GitHub's release verification tools and trusted checksums before installing downloaded software.
Review system activity: Investigate unusual credential use, unexpected API requests, and suspicious access to sensitive files.
Strengthen CI/CD security: Pin dependency hashes, protect contributor accounts with strong authentication, and enable immutable releases.
Conclusion
The OVHcloud CLI incident reinforces the importance of securing every stage of the software supply chain, from developer accounts to release distribution. Organizations should combine account protection, cryptographic verification, immutable releases, and incident-response procedures to reduce the risk of similar attacks.
AESPARROW CONSULTING PVT. LTD. recommends regular software supply chain assessments to identify weaknesses before attackers exploit trusted development and distribution systems.
Frequently Asked Questions
1. What happened in the OVHcloud CLI supply chain attack?
Attackers hijacked a contributor's GitHub account and replaced download archives for five OVHcloud CLI releases with malicious builds designed to steal secrets from affected machines.
2. Which OVHcloud CLI versions were affected?
According to the provided article, the affected releases were v0.11.0 through v0.15.0. Users should consult the official OVHcloud advisory for verified incident details.
3. How long were the malicious OVHcloud CLI archives available?
The source document reports that the altered archives were available for approximately 94 minutes, between 12:47 and 14:21 UTC.
4. Was OVHcloud's source code compromised?
According to the source document, OVHcloud reported that its source code, release tags, and build pipeline were not compromised. The attacker uploaded a separate build directly to existing GitHub releases using a hijacked contributor account.
5. What should users do if they ran a potentially compromised OVHcloud CLI binary?
Users should treat secrets accessible from the affected machine as potentially exposed, rotate API credentials and sensitive keys from a separate trusted device, replace the suspicious binary with a verified release, and review system activity for suspicious behavior.
6. How can organizations prevent software supply chain attacks?
Organizations should protect developer accounts with strong authentication, verify downloaded software using trusted checksums, pin dependency hashes, enable immutable releases, and strengthen CI/CD security controls.
7. Was the OVHcloud CLI incident linked to GlassWorm?
The source document describes a possible connection between the compromised account and the GlassWorm malware campaign, but states that this remains an investigative inference and that the malicious October binary has not been publicly linked to GlassWorm.
Get expert advice
Put this into practice with Aesparrow
Our cybersecurity experts help you find risks, apply best practices and keep your systems secure — with a free, no-obligation assessment to start.
- Expert guidanceTailored security advice
- Proven experienceReal-world expertise
- Trusted partnerYour security first
Keep reading
All articlesMicrosoft Teams IT Support Scams: Malware Risks
Microsoft Teams IT support scams use impersonation, email bombing, and remote-access tools to deliver malware and potentially ransomware. Learn how attackers exploit external Teams chats, gain access to employee devices, and move through corporate networks, along with practical steps organizations…
Cloud Security: Identity Drift and Misconfigurations
Cloud security risks increasingly stem from identity drift, misconfigurations, excessive permissions, and unmanaged APIs. Learn how the shared responsibility model, machine identity governance, encryption, Infrastructure as Code scanning, and automated remediation help organizations protect…
How Network Security Is Evolving: Zero Trust and AI
Network security is evolving beyond traditional firewalls and VPNs as cloud workloads, remote access, and AI-driven threats reshape the attack surface. Discover how Zero Trust, identity-based access, AI-driven network detection, continuous threat exposure management, post-quantum cryptography, and…
Ready to strengthen your security?
Let’s find the gaps before attackers do
Get in touch with our team and start your security journey today.