Science & Tech · Cybersecurity · 2 hrs ago
Backdoored OVHcloud CLI releases targeted developers' stored secrets
Attackers hijacked a developer's GitHub account and used it to alter five releases of OVHcloud's command-line tool, which helps people manage cloud services.
The affected versions were 0.11.0 through 0.15.0, and the malware was designed to steal secrets stored on computers that ran it.
The exposure affected some downloads for macOS, Linux and Windows, but source builds, Docker images and Homebrew installations were not affected.
OVHcloud says its source code and build pipelines were not changed, and the attacker uploaded infected files directly to the releases.
The company removed the affected files and published a clean version, 0.16.0, with a setting that prevents release files from being changed.
Anyone who ran an affected version should treat stored secrets as compromised, clean the system and revoke those secrets.
OVHcloud considers the incident resolved.
Attackers hijacked a contributor’s GitHub account and replaced files in five OVHcloud CLI releases with malware designed to steal secrets from disk.
OVHcloud lists versions 0.11.0 through 0.15.0 as compromised, while versions 0.10.0 and 0.16.0 are clean.
The affected files were available on October 19; the sources give different times for the exposure window.
The attack did not alter OVHcloud’s source code or build pipelines, and source builds and Docker images were unaffected.
OVHcloud says affected users should clean their systems and revoke or change all secrets stored on them.
- Who
- Attackers using a hijacked contributor’s GitHub account targeted OVHcloud CLI users.
- What
- They replaced files in five releases with builds designed to steal secrets from disk.
- When
- October 19, 2026. The sources disagree on the UTC exposure window: one reports 12:47–14:21, while the other gives 14:47–16:21 without specifying a time zone.
- Where
- The OVHcloud CLI repository and release downloads on GitHub.
- Why
- To steal secrets stored on machines running the malicious build.
This story does not have two clearly opposing sides.
Attackers replaced download files in five existing OVHcloud CLI releases; the sources report different UTC exposure windows.
A customer reported the compromised release, and OVHcloud detected and blocked it; BleepingComputer reports 16:21, while The Hacker News reports an end time of 14:21 UTC.
OVHcloud published clean version 0.16.0 as an immutable release, according to The Hacker News.
- Compromised versions
- 0.11.0 through 0.15.0
- Clean versions
- 0.10.0 and 0.16.0
- Affected platforms
- macOS Intel and ARM; Linux x86_64 and ARM64; Windows x86-64
- Unaffected builds
- Source builds and Docker images
- Affected files on v0.15.0
- Six files, including five platform archives and checksums.txt
3 sources
What people are saying
The quality of the binary is poor but it can go all the way. If you are affected, please change all the secrets on your disk.
The compromised versions are v0.11.0 v0.12.0 v0.13.0 v0.14.0 v0.15.0
Posts on X
Si vous avez téléchargé aujourd'hui la dernière version de CLI d'OVHcloud, merci de la mettre à jour à nouveau très rapidement. Sinon effacer. Il s'agit de repo: https://t.co/NkMvygauAb La version CLI de 14h47 a été compromise par un hacker. Nous l'avons détecté et bloqué à
Nous avons terminé l'analyse. L'ensemble de pipelines CI/CD avec de tests unitaires, les tests fonctionnaires, la detection de CVE etc n'ont pas été impactés. Le problème vient de l'option l’immutabilité des releases sur Github qui n'a pas été activée. Donc un user avec les