🚨🇫🇷 GlassWorm-linked actors hijacked OVHcloud CLI releases to spread credential-stealing malware
A compromised developer GitHub account was used to replace binaries attached to OVHcloud CLI releases v0.11.0 through v0.15.0 on October 19.
⠀
The malicious downloads were available between 12:47 and 14:21 UTC and were downloaded approximately 250 times. Only users who installed or updated the CLI during that window are affected. Earlier downloads of those versions remain safe.
⠀
The malware targeted data belonging to VS Code, Cursor, Claude, OpenCode and other developer tools, alongside AWS, Google Cloud, Azure, Docker, Kubernetes, npm, DigitalOcean, SSH and Terraform credentials.
⠀
OVHcloud traced the compromise to GitHub credentials stolen after a developer installed a malicious VS Code extension on a personal MacBook in October 2025. Infrastructure linked to the incident contained indicators previously associated with GlassWorm.
⠀
OVHcloud says its source code and build systems were not compromised and no other repositories were affected. The malicious files were removed, release immutability was enabled and version 0.16.0 was published as a clean release.
Anyone who ran an affected binary should treat secrets stored on that system as compromised, revoke or rotate them, remove the binary and install version 0.16.0.
