OVHcloud GitHub account used to ship malicious CLI binaries
Poisoned ovhcloud-cli releases were online for 1 hour 33 minutes and downloaded about 250 times.
74
Malware
GlassWorm
- Mentions · 7d0
- Mentions · 30d3
- All mentions7
- First seenSep 7, 2026
- Last mentioned21d ago
Timeline
7 articles · newest firstHijacked developer account planted a stealer in OVHcloud CLI
Releases v0.11.0 through v0.15.0 were replaced for about 94 minutes on October 19; v0.16.0 is clean.
74
OVHcloud CLI releases 0.11.0–0.15.0 backdoored on GitHub to steal secrets
A hijacked GitHub account pushed trojanized binaries for about 90 minutes on October 19; 0.10.0 and 0.16.0 are clean.
74
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
58
GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware
GlassWorm-linked VS Code theme extensions hide downloaders that fetch Windows malware, including a blockchain-addressed in-memory loader.
78
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
GlassWorm-linked malicious VS Code color themes on Visual Studio Marketplace and Open VSX shipped staged JavaScript loaders that pulled C2 addresses from Solana memos.
78
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.
72
Appears with
- Socketorganization · 3
- OVHcloudvendor · 3
- Microsoftvendor · 3
- OVHcloud CLIproduct · 2
- Microsoftorganization · 2
- Open VSXproduct · 2
- GitHuborganization · 2
- Visual Studio Codeproduct · 2
- RedExtproduct · 1
- WhatsAppproduct · 1
- Visual Studio Marketplaceproduct · 1
- PEEPproduct · 1
- Open VSXorganization · 1
- PEEP operatorsthreat actor · 1
- BraZetsumalware · 1
- Morphisecorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.