Attacker hijacks contributor GitHub account to swap binaries on five OVHcloud CLI releases with secret-stealing build

Linha do tempo

1. thehackernews.com ↗ · pub. 20/10/2026 05:21 · coletado 20/10 07:00 primeiro registro

   Attacker hijacks contributor GitHub account to swap binaries on five OVHcloud CLI releases with secret-stealing build

   ler a análise desta fonte ocultar

   On 19 October 2026 an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases (v0.11.0 to v0.15.0) of OVHcloud CLI. The swapped files were a build designed to steal secrets stored on the disk of any machine that ran it. They were live from 12:47 to 14:21 UTC (up to 94 minutes) for macOS, Linux x86_64/arm64 and Windows x86_64. OVHcloud deleted the files and published a clean, immutable v0.16.0. OpenSourceMalware links the compromised account to the GlassWorm campaign, but this is the researchers' own inference and no sample of the October binary was preserved. OVHcloud has not said which files the binary reads, where it sends them, how many copies were downloaded, or how the account was compromised; a postmortem is promised.

   Technical Details

   • The release workflow never ran. The attacker uploaded a plain go build of a later commit directly onto old releases, and also replaced checksums.txt so the published hashes matched. The source code, tags and CI/CD pipeline were not touched.
   • The attack worked because GitHub release immutability (generally available since October 2025, protects only releases created after it is enabled) was not enabled, so anyone with write access could replace release assets.
   • Exposed paths: the official install.sh (never checks a hash), manual downloads from release pages, CI jobs fetching archives without a pinned hash, and the CLI's own upgrade command on v0.12.0 to v0.14.0 installs on macOS/Linux set up by script or by hand.
   • Not exposed: Homebrew (the cask pinned the original SHA-256s; the tap's history shows no change), go install or source builds (the v0.15.0 tag still points to 760fd72), the Docker image (last pushed 21 September), and installs made before 12:47 UTC and not updated. The Linux i386, Windows i386, Windows arm64 and WebAssembly builds were not altered.
   • Indicators in go version -m output of the bad build: module version is the pseudo-version v0.15.1-0.20261013083505-5ead8ef9b43d+dirty, the recorded commit is 5ead8ef instead of 760fd72, and an -ldflags="-s -w" line is present. A +dirty marker or vcs lines alone do not indicate compromise: the clean v0.16.0 reports v0.16.0+dirty too.
   • The only published hash of a swapped file is the v0.15.0 Linux arm64 archive.
   • The CLI keeps OVHcloud API credentials in ~/.ovh.conf and environment variables, but all secrets on the disk are considered at risk.
   • A customer's CI job that pinned the SHA-256 of the Linux arm64 archive caught the swap and filed a public issue at 13:50 UTC. The files were deleted at 14:21 UTC and v0.16.0 was published at 17:16 UTC.
   • The hijacked account is a contributor to OVHcloud's documentation repository. Four of its personal repositories were force-pushed on 5-6 March with a loader reading a Solana wallet memo field, the wallet named in GlassWorm's ForceMemo campaign.

   Remediation

   • If a swapped build was run, or you cannot tell, treat every secret readable from that machine as exposed and rotate it, preferably from a different machine.
   • Remove the binary and install v0.16.0, which is immutable and carries a release attestation; verify archives with gh release verify-asset v0.16.0 FILE.
   • Pin SHA-256 hashes in CI and install scripts, and enable release immutability on GitHub repositories.
   • Do not run a suspect binary to check its version; inspect it with go version -m.