OVHcloud

Summary

On 19 October 2026, five OVHcloud CLI releases (v0.11.0-v0.15.0) were modified to distribute an information-stealing binary that retrieved secrets from disk. The releases were live for about 1 hour 34 minutes before being blocked. OpenSourceMalware linked the operation to GlassWorm, while describing the connection to an earlier developer-account compromise as inferential.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The OVHcloud incident began with the compromise of a GitHub account belonging to an OVHcloud contributor. The account had been compromised for approximately seven months before the attack was discovered. In March 2026, the account holder’s personal repositories had their history rewritten, and a hidden loader was planted to retrieve a subsequent stage through a Solana blockchain transaction. The wallet associated with that transaction was identified as a known GlassWorm indicator, although OpenSourceMalware described the connection between the March activity and the October OVHcloud attack as an inference. OpenSourceMalware tied the OVHcloud attack to the GlassWorm threat actors, which had targeted software developers since at least early 2025 because of their access to source-code repositories, cloud platforms, CI/CD pipelines, and package registries. In May 2026, CrowdStrike, Google, and the Shadowserver Foundation disrupted the GlassWorm botnet by simultaneously taking down its four command-and-control channels.

On October 19, the attacker used the compromised contributor account to replace files in five existing GitHub releases of OVHcloud’s command-line interface. The affected versions ranged from v0.11.0 through v0.15.0. The malicious activity began at 14.47 and was blocked at 16.21 after a customer reported the problem. Version v0.10.0 was unaffected, and OVHcloud subsequently published v0.16.0 as a clean release. The attacker did not alter OVHcloud’s source repository or CI/CD pipelines. Instead, the malicious binary was built on an attacker-controlled workstation and uploaded over the legitimate release assets. Its function was to retrieve secrets from disk. OVHcloud CEO Octave Klaba said the binary was poorly produced but still capable of operating on affected systems.

The attack succeeded because GitHub’s release-immutability option had not been enabled for the CLI project. With the appropriate permissions on the compromised account, the attacker could directly replace files in existing releases without passing through OVHcloud’s CI/CD process or its associated checks. The release immutability option enabled authorized users to modify releases directly without those controls. OVHcloud’s internal analysis found that its CI/CD pipelines had not been affected, including unit testing, functional testing, and CVE detection. The source code itself also remained unchanged.

The replacement affected users who obtained the CLI through install.sh, the Homebrew cask for `ovh/tap/ovhcloud-cli`, or tarballs downloaded from GitHub during the compromised window. The malicious releases targeted macOS, Linux on x86_64 and arm64, and Windows on x86_64. Users who built the CLI from source or obtained it through the Go module proxy were not affected, as was anyone who used the Docker image. The source material did not identify specific secrets that were accessed or confirm the extent of any exfiltration. OVHcloud did report that the binary’s purpose was to collect secrets stored on disk, and customers who had installed a tampered version were instructed to change every secret stored on the affected machine.

OVHcloud alerted customers to the compromise, and Klaba publicly disclosed the incident on X. The company deleted the malicious files from the affected GitHub releases and released a clean v0.16.0 version. Because the files were removed before researchers could archive them, OpenSourceMalware was unable to analyze the payload. After completing its analysis and determining that the CI/CD pipelines remained uncompromised, OVHcloud enabled GitHub’s release-immutability option and considered the incident closed.

Sources

Sources available to members: 2 sources.