Info-stealing malware slipped into OVHcloud CLI releases on GitHub
ID: 692bb1e7-0538-5a1f-a60f-fab38bc2a195
STIX ID: report--692bb1e7-0538-5a1f-a60f-fab38bc2a195
Feed Name: Help Net Security
Threat Score
OVHcloud disclosed that five GitHub release assets for its CLI (v0.11.0–v0.15.0) were tampered with on Oct 19 and replaced by a credential-harvesting binary uploaded via a compromised developer account; the malicious assets were removed, OVHcloud enabled GitHub release immutability and advised affected users to rotate secrets, while community analysts linked the incident to the GlassWorm operators.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.