MicrosoftAnalysisAttackers hijack OVHcloud CLI GitHub releases to distribute secret-stealing backdoor
What happened.Cloud infrastructure provider OVHcloud notified customers that an unauthorized actor compromised a contributor account to replace official command-line interface release binaries with infostealing malware on GitHub.
Why it matters.Developer tooling compromises present a direct avenue for attackers to extract privileged production cloud keys. Security teams should enforce cryptographic checksum verification within CI workflows, turn on repository release protection rules, and invalidate developer secrets present on machines that ran vulnerable CLI builds.
The technical specifications:
- Repository breach: Attackers abused an account with write permissions on the official OVHcloud repository to overwrite historical release packages spanning versions v0.11.0 through v0.15.0.
- Malicious behavior: The tampered executable scanned local filesystems to locate developer credentials, cloud API tokens, and SSH keys for automated remote exfiltration.
- Remediation steps: OVHcloud released clean version v0.16.0, activated GitHub release immutability settings, and advised affected developers to rotate all credentials exposed on compromised workstations.