Threat reportSupply ChainTL-2026-3947
OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)
OVHcloud CLI GitHub Releases Hijacked to Distribute (TL-2026-3947), also tracked as OVHcloud CLI supply chain compromise, is a high-severity supply-chain compromise, first published 2026-10-20 and last reviewed 2026-10-24. It is attributed to GlassWorm with medium confidence, affects OVHcloud ovhcloud-cli (GitHub release assets), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1027.013), and is covered by 9 detection rules and 57 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 1GlassWorm
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 57Indicators of compromise
Key facts for TL-2026-3947
- Threat ID
- TL-2026-3947
- Also known as
- OVHcloud CLI supply chain compromise
- Severity
- HIGH
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- GlassWorm
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud services, software development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 57
- Updates
- 2026-10-24 · 6 updates · revalidated 6× · latest source
Malware and tooling in OVHcloud CLI GitHub Releases Hijacked to Distribute
Malware and tooling: ForceMemo, GlassWorm, ovhcloud-cli
How OVHcloud CLI GitHub Releases Hijacked to Distribute works
An attacker using a compromised OVHcloud contributor GitHub account (HassenBF) replaced six assets on each of five existing ovhcloud-cli releases (v0.11.0-v0.15.0) with a trojanized build that steals secrets stored on disk. The malicious assets were live for 94 minutes on 2026-10-19 (12:47-14:21 UTC) before OVHcloud removed them and published an immutable v0.16.0.
On 2026-10-19 an attacker with write access via a hijacked contributor account (GitHub user HassenBF, ID 4911006, a non-public member of the ovh organization) uploaded tampered release assets to the official github.com/ovh/ovhcloud-cli releases page. Rather than pushing new versions or running the CI/CD pipeline, the attacker overwrote existing assets on v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0: the macOS x86_64/arm64, Linux x86_64/arm64 and Windows x86_64 archives plus checksums.txt (hashes updated to match the malicious binaries). Linux i386, Windows i386, Windows arm64 and WebAssembly builds were untouched. v0.10.0 is clean. Release immutability was not enabled on the legacy releases, which is the stated root cause. The malicious window is reported as 12:47-14:21 UTC (94 minutes); OpenSourceMalware places the asset replacement itself at 12:47-13:12 UTC. The original hunt feed quoted 14:47-16:21, which is consistent with UTC+2 local time; UTC values from the technical write-ups are used here.
Detection came from a customer CI job that pinned the SHA-256 of ovhcloud-cli_Linux_arm64.tar.gz and began failing; the reporter opened GitHub issue #300 at about 13:50 UTC. Inspecting the binary with go version -m showed the tampered v0.15.0 Linux arm64 build carried the pseudo-version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, revision 5ead8ef9b43d354dfb5caadff803b11afc8c5c58 (genuine release: 760fd72), vcs.modified=true, a build timestamp of 2026-10-13T08:35:05Z, a '-ldflags=-s -w' flag absent from genuine releases, and no internal/version.Version linker flag. The original and malicious Linux arm64 archive hashes are 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 and 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb.
OVHcloud states the binary was designed to retrieve secrets from disk, including the local .ovh.conf file and the application key, application secret and consumer key environment variables; CEO Octave Klaba described the malware quality as poor but able to go all the way. OpenSourceMalware's analysis reports a geofence (waits 10 seconds, then exits if the system looks Russian: a Russian language indicator plus a Russian timezone or UTC offset between +2 and +12), a throttle file ~/init.json so the payload re-runs at most every two days, and a second stage retrieved through a Solana dead-drop (wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC, base64 JSON in transaction memos) and decrypted with AES-256-CBC. Secrets at risk include OVHcloud API/consumer keys, cloud provider credentials, SSH keys, .npmrc/.pypirc/.netrc tokens and Kubernetes configs. Exfiltration destinations and C2 endpoints for the binary itself were not publicly confirmed in the sources.
Exposed install paths: the official install.sh (no hash verification), direct release downloads, CI jobs fetching archives without pinned hashes, and the CLI's built-in upgrade command (macOS/Linux). Homebrew (pinned SHA-256), go install, source builds, Docker images and pre-compromise installs were not affected, per SecurityOnline. OVHcloud removed the assets at 14:21 UTC, published v0.16.0 with a signed tag at about 17:16 UTC marked immutable, and enabled release immutability.
Attribution is tentative. OpenSourceMalware links the account to GlassWorm (ForceMemo campaign) through a shared Solana wallet in public GlassWorm indicator lists and amend-and-force-push loader injection into the account's personal repositories from 2026-03-05, but states that the link between the March compromise and the October replacement rests on the shared account identity, not on direct observation, and calls it an inference. The initial access method for the account (infostealer versus token theft) and the exposure of the TAP_GITHUB_TOKEN remain unresolved.
MITRE ATT&CK techniques used in TL-2026-3947
Collection
T1005 Data from Local System; T1074.001 Data Staged
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.007 JavaScript; T1204.002 User Execution
Command and Control
T1071.001 Application Layer Protocol; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1132.001 Data Encoding; T1573.001 Symmetric Cryptography
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.001 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Discovery
T1083 File and Directory Discovery; T1614.001 System Language Discovery
Persistence
T1176 Software Extensions; T1543.001 Create or Modify System Process
Credential Access
T1552.001 Credentials In Files; T1552.004 Private Keys
Resource Development
Affected products and versions in OVHcloud CLI GitHub Releases Hijacked to Distribute
- OVHcloud — ovhcloud-cli (GitHub release assets)
Vulnerable versions: v0.11.0; v0.12.0; v0.13.0; v0.14.0; v0.15.0 (macOS x86_64/arm64, Linux x86_64/arm64, Windows x86_64 archives downloaded from GitHub releases or install.sh in the exposure window)
Fixed in: v0.16.0 (immutable); v0.10.0 (clean)
Remediation for OVHcloud CLI GitHub Releases Hijacked to Distribute
Patches
- Upgrade to ovhcloud-cli v0.16.0 (immutable release, signed tag)
Immediate actions
- Delete any ovhcloud-cli binary obtained from GitHub releases or install.sh between 2026-10-19 12:47 and 14:21 UTC, or any v0.11.0-v0.15.0 binary, and update to v0.16.0
- Treat every secret readable on a machine that ran an affected binary as exposed: rotate OVHcloud application/consumer keys (~/.ovh.conf, environment variables), cloud provider credentials, SSH keys, .npmrc/.pypirc/.netrc tokens and Kubernetes configs, from a separate clean machine
- Check hosts for the ~/init.json throttle file and for binaries matching the malicious SHA-256 hashes
- Verify downloaded assets with gh release verify-asset against the immutable v0.16.0 release
Workarounds
- Avoid the CLI's built-in upgrade command and install.sh until verified; install via pinned Homebrew cask or build from source
Longer-term hardening
- Pin SHA-256 hashes for third-party binaries fetched in CI/CD and verify against an independent source, not the checksums.txt hosted beside the asset
- Prefer go install, source builds or pinned Homebrew casks over unpinned prebuilt release downloads
- Enable release immutability and signed tags on all repositories, including legacy releases
- Enforce MFA and short-lived tokens for contributor accounts and audit write access of non-public organization members
Weaknesses (CWE) in OVHcloud CLI GitHub Releases Hijacked to Distribute
Timeline of OVHcloud CLI GitHub Releases Hijacked to Distribute
- The contributor's personal MacBook is compromised through the malicious VS Code extension color-picker-universal 2.8.91, which OVHcloud attributes to GlassWorm. GitHub credentials are stolen and a persistent NodeJS service is set up. The contributor's OVHcloud-issued laptop was not affected.
- Earliest observed activity on the Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC later used as the GlassWorm ForceMemo dead drop (per StepSecurity).
- Earliest verified attacker activity on the HassenBF GitHub account (02:41:17 UTC): four personal repositories force-pushed within 42 seconds with an injected preinstall.js loader (amend-and-force-push), per OpenSourceMalware.
- Force push to the padel-bot repository adds a preinstall.js loader (22:49:53 UTC), the fourth HassenBF personal repository modified in the ForceMemo-style amend-and-force-push pattern.
- StepSecurity publicly disclosed the ForceMemo campaign: hundreds of GitHub Python repositories compromised through account takeover and force-push.
- Earliest of the affected releases (v0.11.0) published; v0.11.0-v0.15.0 were published between 2026-04-14 and 2026-09-16.
- CrowdStrike, Google and Shadowserver disrupt GlassWorm's four C2 channels (Solana memos, BitTorrent DHT, Google Calendar dead drops, VPS servers). CrowdStrike assesses the operators as probably Russia-based, without conclusive evidence.
- Legitimate ovhcloud-cli v0.15.0 published (genuine commit 760fd72).
- Build source commit 5ead8ef9b43d354dfb5caadff803b11afc8c5c58 dated 2026-10-13T08:35:05Z, later embedded in the trojanized binaries with vcs.modified=true.
- Branches dev/test-changest and test/trigger-probe deleted from the repository (14:34:11 UTC), four days before the asset replacement.
- OVHcloud CEO Octave Klaba publicly confirms the compromise on X, advising users to delete or update the CLI and change all secrets stored on disk; notes release immutability was disabled.
- OVHcloud publishes immutable v0.16.0 with a signed tag at about 17:16 UTC, enables release immutability, and advises rotating all locally stored secrets.
- OVHcloud removes the malicious assets at 14:21 UTC, closing a 94-minute exposure window (12:47-14:21 UTC).
- Customer CI job pinning the SHA-256 of ovhcloud-cli_Linux_arm64.tar.gz fails; issue #300 opened at about 13:50 UTC with go version -m evidence.
- Attacker uploads tampered archives and checksums.txt to five existing releases between 12:47 and 13:12 UTC; the CI/CD pipeline was never run.
- OVHcloud publishes GHSA-862f-55f5-vmvw with the malicious MD5s, the Solana wallets, exfiltration server 45.32.148.174:443 and remediation steps. The malicious assets were downloaded about 250 times, and the account was suspended.
- Security press (Cyber Security News and others) report the incident; OpenSourceMalware attributes it tentatively to GlassWorm.
- 20:26 UTC: the attacker-controlled loader repositories were force-pushed again and history rolled back; StepSecurity recovered the stage-1 preinstall.js from an orphaned commit.
- SecurityWeek publishes coverage; OVHcloud has not publicly confirmed the GlassWorm attribution.
Update history for TL-2026-3947
- 2026-10-24 — OVHcloud CLI Compromised via GitHub Release Swap Delivering GlassWorm Loader (GHSA-862f-55f5-vmvw): What changed No severity, exploitability or status change; HIGH / ACTIVE / MONITORING remain accurate. The update is additive intelligence only. New indicators (2) Exfiltration URL path 45.32.148.174/upload and the 'ovhcloud upgrade' develo
- 2026-10-21 — GlassWorm-Linked Supply-Chain Compromise of OVHcloud CLI GitHub Releases (ovh/ovhcloud-cli v0.11.0-v0.15.0, GHSA-862f-55f5-vmvw): What changed Severity, exploitability and status are unchanged (HIGH / ACTIVE / MONITORING). The incident was contained on 2026-10-19, so the report's own 'ACTIVE' status label was not applied. New scope detail: about 250 downloads of the m
- 2026-10-21 — Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI Releases v0.11.0-v0.15.0 (GlassWorm-linked): What changed No field escalation. Severity HIGH and exploitability ACTIVE are unchanged. The report's status ACTIVE (vs existing MONITORING) and attribution confidence MEDIUM (vs LOW) are not applied: the incident is contained (assets remov
- 2026-10-21 — OVHcloud CLI (ovh/ovhcloud-cli) GitHub Release Assets Replaced with Secret-Stealing Malware via Hijacked Developer Account (v0.11.0-v0.15.0, suspected GlassWorm): What changed No field changes; severity HIGH, exploitability ACTIVE, status MONITORING and LOW attribution confidence remain appropriate. New indicators (7) 5 per-platform MD5s of the malicious binaries (Darwin arm64/x86_64, Linux arm64/x86
- 2026-10-20 — OVHcloud CLI GitHub releases backdoored in GlassWorm-linked supply-chain compromise to steal developer secrets: What changed No severity, exploitability, status or attribution field changes. Additions are technical detail only. New indicators (2) AES-256-CBC key and IV for the stage-two decryption, plus the 'node preinstall.js' loader execution chain
- 2026-10-20 — OVHcloud CLI Supply Chain Compromise: Five GitHub Releases (v0.11.0-v0.15.0) Replaced With Secret-Stealing Builds via Hijacked Contributor Account: What changed No severity, exploitability, status or attribution change. Additive context only; existing HIGH / ACTIVE / MONITORING / LOW-confidence GlassWorm attribution retained. New indicators (12) Go pseudo-version and vcs.modified build
Sources cited for OVHcloud CLI GitHub Releases Hijacked to Distribute
- Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware
- Glassworm Hacks OVH Clouds CLI tool (OpenSourceMalware)
- Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (The Hacker News)
- OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build (SecurityOnline)
- ovhcloud-cli issue #300 (customer CI hash mismatch report)
- ovh/ovhcloud-cli GitHub releases
- OVHcloud : les binaires de la CLI officielle piégés sur GitHub avec un infostealer (IT-Connect)
- OVHcloud warns compromised CLI versions could steal local secrets (RuntimeWire)
Detection coverage for TL-2026-3947
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3947 across Splunk SPL, Microsoft KQL and Sigma, covering 57 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.