OVHcloud says attackers compromised its open-source command-line tool on GitHub and distributed malware-laced releases that could steal secrets from affected machines. The attacker used a hijacked developer GitHub account to modify OVHcloud CLI versions 0.11.0 through 0.15.0 on October 19, 2026; source builds and Docker images were not affected, and OVHcloud says version 0.16.0 is clean. Researchers cited by the report link the activity to GlassWorm indicators and say the tampered binaries targeted Windows, macOS, and Linux.
Why it matters: Anyone who downloaded or ran the affected OVHcloud CLI binaries should treat local secrets as stolen, remove the tool, and rotate credentials immediately. This is urgent because a trusted admin and developer tool was turned into a malware delivery channel through official GitHub releases.
Bill Toulas
2026.10.20
100% relevant
This article establishes a distinct supply-chain incident: OVHcloud's official CLI releases on GitHub were altered via a compromised developer account to deliver secret-stealing malware.
← Back to all stories