# OVHcloud CLI Downloads Compromised by Malware Attack

*Published October 21, 2026*
*Source: [https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html](https://thehackernews.com/2026/10/hackers-hijack-five-ovhcloud-cli.html)*

## Executive Summary

Attackers compromised OVHcloud's CLI downloads on GitHub by replacing files with a malicious build designed to steal secrets. The breach affected several versions of the CLI across multiple platforms, prompting OVHcloud to release a clean update and advise users to change their credentials.

## Article

A significant security breach occurred on October 19 when attackers used a hijacked GitHub account to replace download archives of OVHcloud's command-line tool with a malicious build. This modified release, available for a brief window of 94 minutes, was engineered to extract sensitive information from the machines of users who installed or updated the OVHcloud CLI during that time. The affected platforms were macOS, Linux x86_64 or arm64, and Windows x86_64.

Following the discovery of the breach, OVHcloud promptly removed the compromised files and released a clean version 0.16.0 as an immutable release, ensuring no further unauthorized modifications could occur. The attack specifically targeted versions v0.11.0 through v0.15.0, leaving earlier versions like v0.10.0 unaffected. The breach was identified when a customer discovered discrepancies in the Linux arm64 binary, which prompted OVHcloud to take swift action.

OVHcloud founder Octave Klaba advised affected users to change all credentials stored on their devices. Although specifics about which files were accessed by the malicious build are not yet disclosed, the CLI is known to store API credentials in specific configuration files. The incident underscores the importance of enabling GitHub's release immutability option, a setting that OVHcloud had not activated prior to the breach.

The compromised contributor account is linked to the GlassWorm malware campaign, which has previously injected malicious code into various repositories. Although there is no direct evidence linking the October attack to GlassWorm, the shared account is a crucial connection. OVHcloud has committed to providing a comprehensive postmortem to shed light on the incident and its ramifications.