OVH Cloud CLI Tool Hacked by Russian Threat Actors

On 19 October 2026 the OVHcloud CLI release assets for versions v0.11.0 through v0.15.0 were replaced with malicious builds between roughly 12:47 and 13:12 UTC. Five releases had their mainstream platform binaries swapped (Darwin arm64/x86_64, Linux x86_64/arm64, Windows x86_64) and checksums.txt updated; i386, Windows arm64 and WASM artifacts were left untouched. A downstream CI job that pinned a SHA-256 flagged the tamper within 94 minutes, prompting OVHcloud to delete the replaced files at 14:21 UTC and publish a clean, immutable v0.16.0 with a release attestation about three hours later. The malicious binary appears designed to harvest credentials from developer and ops workstations; only one reporter-supplied bad hash is available because OVHcloud removed the files before broader analysis.

Technical analysis attributes the intrusion to a compromised contributor GitHub account (HassenBF) rather than CI or pipeline compromise. Server-side data show no release workflow runs during the window and the replaced assets were uploaded via the Releases API by that human account, implying the attacker had repo write rights. Build metadata extracted from the reporter’s sample shows a dirty local go build from commit 5ead8ef (a later, v0.16-era tree) without GoReleaser flags, meaning the malware was patched into a local checkout and never committed. The contributor account exhibits a March 2026 forced-history rewrite and a hidden preinstall.js linked to a Solana memo dead drop and known GlassWorm indicators; however, the payload was deleted and some timing links rely on the reporter’s captures rather than archived artifacts.