Threat Intelligence

OVHcloud Command-Line Tool Hijacked: Five Releases Swapped With Secret-Stealing Malware

The Hacker News · 20 Oct 2026

Key Takeaway If anyone in your business installed or updated the OVHcloud CLI on Monday 19 October during the window, rotate every credential stored on that machine, and verify downloaded tools through a trusted source rather than relying on files from the same place.

On Monday, October 19, an attacker took over a contributor's GitHub account and replaced the download archives on five existing releases of OVHcloud's command-line tool. OVHcloud says the new files were a build designed to steal secrets stored on the disk of any machine that runs it. The swapped files were live for up to 94 minutes, from 12:47 to 14:21 UTC.

Only people who installed or updated the tool in that window, through a path that does not check a file hash, on macOS, Linux (x86_64 or arm64) or Windows x86_64 were affected. The attacker also replaced the checksums file on v0.15.0, so the published hashes matched the malicious binaries. OVHcloud lists v0.11.0 through v0.15.0 as compromised and v0.10.0 as clean. Its source code, release tag and build pipeline were not touched. OVHcloud has deleted the swapped archives and published a clean v0.16.0 as an immutable release, which GitHub does not allow anyone to change.

A customer spotted the swap by reading build information from the new binary without running it. The Hacker News notes that some advice circulating online about flagging builds marked +dirty would wrongly catch OVHcloud's own clean release. Running a suspect binary to test it is not advisable. OVHcloud founder Octave Klaba said anyone affected should change every secret stored on the disk.

supply chain attack OVHcloud GitHub credential theft

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.