Hackers Hijack OVHcloud CLI Releases to Distribute Secret-Stealing Malware

Incident Overview

An attacker leveraged a compromised contributor account to replace download archives on five existing releases of the OVHcloud command-line interface (CLI) tool. According to the cloud provider and independent security analysis, the malicious builds remained active on GitHub for up to 94 minutes before being discovered and removed.

The incident impacted users who installed or updated the OVHcloud CLI during the specified window without verifying cryptographic hashes. OVHcloud confirmed that the company's source code repositories, release tags, and build pipelines were not compromised during the event.

Affected Versions and Platforms

Releases v0.11.0 through v0.15.0 were found to be affected by the substitution. The unauthorized files were uploaded directly to releases published between April and September.

• Compromised Releases: v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0
• Unaffected Releases: v0.10.0 and the newly published v0.16.0
• Affected Architectures: Specific archives for macOS (x86_64 and arm64), Linux (x86_64 and arm64), and Windows (x86_64) were replaced, along with corresponding checksum files.
• Unaffected Builds: Linux i386, Windows i386, Windows arm64, and WebAssembly builds remained unaltered across all affected releases.

Exposure Vectors

Users who downloaded or updated the CLI using specific pathways during the incident window may have received the modified binary:

• Running the official install script directly from the repository.
• Manually downloading archives from the GitHub release pages of the five affected versions.
• Executing CI/CD jobs or build steps that fetch release artifacts without pinned cryptographic hashes.
• Using the CLI's native upgrade command on vulnerable macOS or Linux installations.

Protected Paths: Users who installed via Homebrew experienced failures rather than exposure, as Homebrew pins the original SHA-256 hashes and rejects mismatched downloads. Docker images, manual source builds using `go install`, and installations performed prior to the incident window without updates remained secure.

Technical Indicators

A customer discovered the anomaly by inspecting a downloaded Linux arm64 binary using the `go version -m` command. Key characteristics identified in the modified build include:

• A pseudo-version string (e.g., `v0.15.1-0.20261013083505-5ead8ef9b43d+dirty`) indicating an untagged commit.
• A recorded commit hash differing from the official release tag pointer.
• The presence of `-ldflags="-s -w"`, which is omitted in genuine OVHcloud compilation pipelines.

Security researchers have linked the compromised contributor account to prior campaigns associated with the GlassWorm malware framework, though direct analysis of the swapped payload remains pending due to the absence of preserved public copies.

Recommended Remediation Steps

Cloud provider leadership and security investigators recommend immediate remediation for anyone who ran a potentially compromised build:

1. Rotate Credentials: Treat all secrets, API keys, and configuration data stored on the affected machine as compromised. Rotate credentials immediately from a separate, secure device.
2. Remove Binary: Delete the malicious CLI binary from the local system.
3. Upgrade to Secure Release: Install OVHcloud CLI version v0.16.0, which has been published as an immutable release with signed attestation.
4. Verify Assets: Use official GitHub tooling (`gh release verify-asset`) to ensure integrity when downloading future updates.