Key Takeaways:
- Hackers used a stolen developer account to release infected versions of OVHcloud’s command-line tool.
- The malware targets developer computers to steal passwords, access keys, and other sensitive data.
- Security researchers link the OVHcloud GitHub attack to a hacking campaign known as GlassWorm.
French cloud provider OVHcloud warned users on October 19 that hackers had taken control of a developer’s GitHub account and used it to release infected software. The malware was designed to steal sensitive information stored on users’ computers.
OVHcloud Finds Infected Versions of Its Tool
OVHcloud said the OVHcloud GitHub attack involved hackers modifying several versions of its command-line tool, which developers and system administrators use to manage cloud services and automate tasks. The affected versions ranged from 0.11.0 to 0.15.0 and were available on GitHub.
Company CEO Octave Klaba disclosed the breach after a customer report helped identify the problem. OVHcloud said it detected and stopped the unauthorized releases on October 19, between 14:47 and 16:21.
Neither the older version 0.10.0 nor the newer version 0.16.0 was affected. The malware was designed to collect sensitive information stored on users’ computers.
OVHcloud urged anyone who downloaded an infected version to remove it, check their computer for malware, and change any passwords or access keys that may have been exposed.
GitHub Settings Allowed Hackers to Change Releases
The investigation into the OVHcloud GitHub attack found that GitHub’s setting to prevent changes to published software releases was turned off during the incident. This allowed someone with access to the developer account to change existing releases without the usual safeguards.
Researchers said the attacker did not tamper with the automated systems used to build and test the software. Instead, the attacker uploaded infected packages built on a separate computer.
OVHcloud said its automated build systems, software tests, and security checks continued to work normally throughout the incident. The source code and Docker container images were not changed as part of the attack.
The company then enabled GitHub’s release protection setting to help prevent similar incidents. OVHcloud said it had fixed the repository security issue.
Researchers Link the Attack to GlassWorm
The cybersecurity research group OpenSourceMalware linked the incident to GlassWorm, a hacking campaign that has targeted software development tools and platforms since late 2025.
Researchers said the attackers had controlled the compromised developer account for more than six months. Public records also showed suspicious activity in its software repositories before the infected releases appeared.
The investigation found that someone had rewritten the repository’s history on March 5, 2026, and added a hidden program that ran during software setup. That program used a Solana blockchain memo to find instructions for downloading another stage of the malware.
The infected software could affect macOS computers with Intel or Apple chips, Linux systems, and Windows computers.
Security experts advise developers affected by the OVHcloud GitHub attack who ran an affected version to assume that passwords, access keys, and other sensitive information stored on their computers may have been exposed. They should change those credentials and check their systems for signs of infection.
Visit more of our news! CyberPro Magazine
