OVHcloud says hijacked account pushed secret-stealing malware

OVHcloud said its contributor’s GitHub account was hijacked on Oct. 19, 2026, and used to replace five CLI releases with secret-stealing malware. The malicious binaries were live on GitHub for up to 94 minutes before detection and removal, targeting macOS, Linux, and Windows users who installed or updated the CLI during that window.

The OVHcloud CLI is an open-source tool used by system administrators and developers to manage cloud and hosting services via terminal commands, including automation tasks. Because the CLI stores OVHcloud API credentials in `~/.ovh.conf` and environment variables, a compromised binary can expose the secrets needed to access cloud infrastructure.

The compromised releases spanned versions v0.11.0 through v0.15.0, originally published between Apr. 14 and Sept. 16, 2026. Attackers replaced the binary files attached to these releases on Oct. 19, 2026, without modifying the source code, release tags, or CI/CD (continuous integration and continuous deployment) pipelines. The malware operated from 12:47 UTC to 14:21 UTC that day, and OVHcloud’s release pipeline did not run from Oct. 16 until the v0.16.0 release, so no automated checks caught the malicious files.

The attack was discovered at 13:50 UTC when a customer’s CI job failed because a pinned SHA-256 hash for the Linux arm64 archive no longer matched the file on GitHub. OVHcloud took down the malicious files at 14:21 UTC and published v0.16.0 under the ovh-cds account with a signed tag at 17:16 UTC. The new release carries a signed attestation so users can verify file integrity, and OVHcloud also activated GitHub’s release immutability after the incident, which prevents existing releases from being modified.

The hijacked account belonged to a contributor with access to OVHcloud’s documentation repository, not a public member of the organization. GitHub’s release immutability feature was disabled for OVHcloud’s repository at the time of the attack, allowing attackers to modify existing releases without triggering CI/CD checks. The account was compromised for more than six months before the Oct. 19 attack, with evidence of scripted history rewrites on Mar. 5–6, 2026.

Inside the compromised account was a hidden `preinstall.js` loader that decoded a second-stage payload through a Solana wallet memo dead drop, a technique consistent with GlassWorm’s known tactics. OpenSourceMalware researchers suggested a possible link between the compromised account and GlassWorm based on shared indicators, though they found no direct evidence connecting the malicious CLI binary to the campaign. OpenSourceMalware verified that a loader file in one of the attacker‘s repositories matched the hash the researchers had published.

The GlassWorm campaign has gone after developer ecosystems since late 2025, including VSCode, OpenVSX, GitHub, and npm, with stolen GitHub tokens used to force-push malware. During the ForceMemo operation in March 2026, GlassWorm force-pushed malware into hundreds of Python repositories with stolen GitHub tokens. GlassWorm distributes malware through invisible Unicode characters and Solana wallet memos.

The compromised releases replaced six files across platforms: macOS (x86_64 and arm64), Linux (x86_64 and arm64), Windows (x86_64), and checksums.txt to match the malicious binaries. Linux i386, Windows i386, Windows arm64, and WebAssembly builds were unaffected. After OVHcloud removed the malicious files, the compromised releases now only include the four untouched archive files.

Anyone who installed the CLI through the official install script, grabbed archives directly from GitHub, or ran the CLI’s upgrade command without checking file hashes was exposed. Homebrew users were safe because the cask locked each archive to its original SHA-256 hash, which blocked the malicious binaries from being installed. The Docker image, last rebuilt before Sept. 21, 2026, was not affected, and users who installed via `go install` or compiled from source were also safe because the v0.15.0 tag still pointed to the original commit.

OVHcloud founder Octave Klaba advised affected users to rotate all secrets on their disks, remove the compromised binary, and install v0.16.0 to mitigate the risk. “If you are affected, please change all the secrets on your disk,” Klaba said.

The compromised v0.15.0 Linux arm64 archive has a SHA-256 hash of `3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb`, while the genuine archive’s hash is `5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0`. Users can check their downloads with `gh release verify-asset v0.16.0 FILE`. The malicious binary’s build metadata contains a `-ldflags=”-s -w”` line that genuine OVHcloud releases do not have, and its commit hash (`5ead8ef`) does not match the genuine v0.15.0 commit hash (`760fd72`).

OVHcloud has not disclosed the specific secrets targeted by the malware, how many copies were downloaded, or where the stolen data was sent. The company has promised a detailed postmortem report in the coming days.