# OVHcloud CLI GitHub Releases Hijacked to Distribute Secret-Stealing Malware (v0.11.0-v0.15.0)

> An attacker using a compromised OVHcloud contributor GitHub account (HassenBF) replaced six assets on each of five existing ovhcloud-cli releases (v0.11.0-v0.15.0) with a trojanized build that steals secrets stored on disk. The malicious assets were live for 94 minutes on 2026-10-19 (12:47-14:21 UTC) before OVHcloud removed them and published an immutable v0.16.0.

- **Published:** 2026-10-20T09:29:04Z
- **Last reviewed:** 2026-10-24T07:56:19.729Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3947
- **ID:** TL-2026-3947
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** GlassWorm
- **Detections:** 9 · **IOCs:** 57 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-19 an attacker with write access via a hijacked contributor account (GitHub user HassenBF, ID 4911006, a non-public member of the ovh organization) uploaded tampered release assets to the official github.com/ovh/ovhcloud-cli releases page. Rather than pushing new versions or running the CI/CD pipeline, the attacker overwrote existing assets on v0.11.0, v0.12.0, v0.13.0, v0.14.0 and v0.15.0: the macOS x86_64/arm64, Linux x86_64/arm64 and Windows x86_64 archives plus checksums.txt (hashes updated to match the malicious binaries). Linux i386, Windows i386, Windows arm64 and WebAssembly builds were untouched. v0.10.0 is clean. Release immutability was not enabled on the legacy releases, which is the stated root cause. The malicious window is reported as 12:47-14:21 UTC (94 minutes); OpenSourceMalware places the asset replacement itself at 12:47-13:12 UTC. The original hunt feed quoted 14:47-16:21, which is consistent with UTC+2 local time; UTC values from the technical write-ups are used here.

Detection came from a customer CI job that pinned the SHA-256 of ovhcloud-cli_Linux_arm64.tar.gz and began failing; the reporter opened GitHub issue #300 at about 13:50 UTC. Inspecting the binary with go version -m showed the tampered v0.15.0 Linux arm64 build carried the pseudo-version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, revision 5ead8ef9b43d354dfb5caadff803b11afc8c5c58 (genuine release: 760fd72), vcs.modified=true, a build timestamp of 2026-10-13T08:35:05Z, a '-ldflags=-s -w' flag absent from genuine releases, and no internal/version.Version linker flag. The original and malicious Linux arm64 archive hashes are 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 and 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb.

OVHcloud states the binary was designed to retrieve secrets from disk, including the local .ovh.conf file and the application key, application secret and consumer key environment variables; CEO Octave Klaba described the malware quality as poor but able to go all the way. OpenSourceMalware's analysis reports a geofence (waits 10 seconds, then exits if the system looks Russian: a Russian language indicator plus a Russian timezone or UTC offset between +2 and +12), a throttle file ~/init.json so the payload re-runs at most every two days, and a second stage retrieved through a Solana dead-drop (wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC, base64 JSON in transaction memos) and decrypted with AES-256-CBC. Secrets at risk include OVHcloud API/consumer keys, cloud provider credentials, SSH keys, .npmrc/.pypirc/.netrc tokens and Kubernetes configs. Exfiltration destinations and C2 endpoints for the binary itself were not publicly confirmed in the sources.

Exposed install paths: the official install.sh (no hash verification), direct release downloads, CI jobs fetching archives without pinned hashes, and the CLI's built-in upgrade command (macOS/Linux). Homebrew (pinned SHA-256), go install, source builds, Docker images and pre-compromise installs were not affected, per SecurityOnline. OVHcloud removed the assets at 14:21 UTC, published v0.16.0 with a signed tag at about 17:16 UTC marked immutable, and enabled release immutability.

Attribution is tentative. OpenSourceMalware links the account to GlassWorm (ForceMemo campaign) through a shared Solana wallet in public GlassWorm indicator lists and amend-and-force-push loader injection into the account's personal repositories from 2026-03-05, but states that the link between the March compromise and the October replacement rests on the shared account identity, not on direct observation, and calls it an inference. The initial access method for the account (infostealer versus token theft) and the exposure of the TAP_GITHUB_TOKEN remain unresolved.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1059.007 JavaScript
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1614.001 System Language Discovery
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1005 Data from Local System
- T1102.001 Dead Drop Resolver
- T1573.001 Symmetric Cryptography
- T1204.002 User Execution
- T1027 Obfuscated Files or Information
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1083 File and Directory Discovery
- T1071.001 Application Layer Protocol
- T1586 Compromise Accounts
- T1027.013 Obfuscated Files or Information
- T1195.001 Supply Chain Compromise
- T1041 Exfiltration Over C2 Channel
- T1176 Software Extensions
- T1543.001 Create or Modify System Process
- T1074.001 Data Staged
- T1132.001 Data Encoding

## Sources

- [Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware](https://cybersecuritynews.com/ovhcloud-supply-chain-attack/)
- [Glassworm Hacks OVH Clouds CLI tool (OpenSourceMalware)](https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool)
- [Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (The Hacker News)](https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html)
- [OVHcloud CLI Attack Swaps Release Binaries With a Secret-Stealing Build (SecurityOnline)](https://securityonline.info/ovhcloud-cli-supply-chain-attack/)
- [ovhcloud-cli issue #300 (customer CI hash mismatch report)](https://github.com/ovh/ovhcloud-cli/issues/300)
- [ovh/ovhcloud-cli GitHub releases](https://github.com/ovh/ovhcloud-cli/releases)
- [OVHcloud : les binaires de la CLI officielle piégés sur GitHub avec un infostealer (IT-Connect)](https://it-connect.fr/ovhcloud-cli-binaires-pieges-vol-secrets)
- [OVHcloud warns compromised CLI versions could steal local secrets (RuntimeWire)](https://runtimewire.com/article/ovhcloud-cli-compromised-secrets-october-2026)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3947