OVHcloud GitHub Flaw Lets Attackers Distribute Secret-Stealing Malware

Key Takeaways

• A supply chain attack compromised an OVHcloud developer’s GitHub account to distribute secret-stealing malware via the official OVHcloud CLI.
• The incident occurred on October 19, 2026, affecting CLI versions v0.11.0 through v0.15.0.
• A vigilant customer detected the malicious changes, prompting OVHcloud to block the compromised files within 94 minutes.
• Users who downloaded affected versions are urged to update their CLI and rotate all local secrets.

OVHcloud GitHub Compromise Facilitates Malware Distribution

OVHcloud, a prominent European cloud provider, recently experienced a supply chain attack where malicious software was distributed through its official command-line interface (CLI) releases on GitHub. An attacker gained unauthorized access to an OVHcloud developer’s GitHub account, subsequently using it to inject secret-stealing malware into legitimate CLI downloads.

The incident, which took place on October 19, 2026, targeted users who downloaded specific versions of the OVHcloud CLI. The embedded malware was designed to exfiltrate sensitive credentials stored on users’ local machines. The compromise was swiftly detected by a customer who noticed suspicious alterations to the release files and promptly reported the anomaly to OVHcloud. The cloud provider acted quickly, blocking the malicious files approximately 94 minutes after detection.

According to OVHcloud CEO Octave Klaba, the compromised CLI versions included v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0. Klaba confirmed that version v0.10.0 remained untainted and announced the release of a safe replacement, v0.16.0. This secure version is now accessible on the project’s official GitHub releases page, where it has been marked as immutable to prevent future unauthorized modifications.

Details of the Supply Chain Attack

Klaba’s timeline indicates that the malicious files appeared at 14:47 and were identified and subsequently blocked by 16:21. Initial investigations by OVHcloud suggest that the scope of the breach was limited to the CLI project, with no other repositories or the broader OVHcloud GitHub organization or cloud platform appearing to be affected.

The attacker leveraged an existing developer account to introduce a malicious binary into the software packages distributed via GitHub. This tactic effectively weaponized a trusted download source, diminishing any reason for users to suspect a routine CLI download could compromise their local credentials. OVHcloud has not yet disclosed the method by which the developer account was initially compromised.

The customer’s report specifically highlighted concerns about release files being replaced with a “dirty build” of a later commit. In software development, this term typically refers to builds that contain unrecorded or unauthorized changes beyond the original source revision. The public issue listing, specifically issue #300, documents this report, noting replaced assets for versions v0.13.0 through v0.15.0. OVHcloud’s official warning subsequently extended the list of affected versions to include two additional releases.

The reporting customer also raised questions regarding the identity behind the changes and advocated for the implementation of measures to lock release files against replacement. They noted that they had temporarily switched to building through the Go module proxy while awaiting clarification. The public nature of their report stemmed from the repository’s lack of a private channel for vulnerability disclosures.

Malware Functionality and Potential Impact

Klaba characterized the added program as a binary designed to extract secrets from disk. He noted its “poor quality” but cautioned that it was still capable of achieving its malicious objective. The current public disclosure does not specify which files the malware targeted, the destination for the exfiltrated data, or the total number of users who may have executed the compromised downloads.

The inherent function of the OVHcloud CLI makes this particular threat highly critical. The tool is documented for managing cloud services, account resources, and automated workflows. Its supported authentication methods include a local .ovh.conf file containing credentials, alongside environment variables for application keys, application secrets, and consumer keys.

These documented credential storage locations underscore why a compromised administration tool poses risks far beyond the immediate malicious program. However, it is crucial to note that this is not a confirmed list of the specific malware’s targets. Without further technical findings from OVHcloud, any claims regarding the theft of SSH keys, browser passwords, establishment of persistence, or details about attacker infrastructure would be speculative.

This incident aligns with a broader trend of supply chain attacks where trusted software updates are exploited to steal developer and cloud credentials. Attackers can hijack legitimate software delivery channels to facilitate credential theft, bypassing the need for users to interact with phishing sites or other deceptive tactics.

What You Should Do

• Immediately Update or Delete: Users who downloaded the OVHcloud CLI between October 19, 2026, 14:47 and 16:21 UTC, should immediately update to v0.16.0 or higher, or completely remove the compromised CLI.
• Rotate All Local Secrets: Change all secrets, including API keys, application secrets, and any other credentials, stored on disk on any machine where an affected CLI version was executed. This is critical because replacing the malicious program does not revoke credentials that may have already been exfiltrated.
• Investigate Compromised Machines: Organizations should identify all machines that downloaded and ran affected CLI files, preserve forensic evidence, and review account activity associated with any potentially exposed credentials.
• Extend Scope of Remediation: If other sensitive credentials were accessible on the compromised machines, the remediation efforts should extend beyond just OVHcloud credentials. The company’s warning broadly covers local secrets, not exclusively its own service keys.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.