Hijacked account swapped five OVHcloud CLI releases with a secret-stealer
Original title: Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
The swapped archives were live for up to 94 minutes on October 19 and only reached unhashed installs on selected platforms.
OVHcloud says an attacker used a hijacked contributor GitHub account on October 19 to replace download archives on five existing OVHcloud CLI releases with a build meant to steal secrets stored on disk. The files were live from 12:47 to 14:21 UTC, at most 94 minutes, on macOS, Linux x86_64 or arm64, and Windows x86_64 paths that do not check a hash. Releases v0.11.0 through v0.15.0 are listed as compromised; v0.10.0 is clean. Source, tags, and the build pipeline were not changed. OVHcloud removed the archives and published immutable v0.16.0.
Unconfirmed: OVHcloud has not said which files the binary reads, where it sends them, or how many copies were downloaded, and no swapped archive has been publicly analyzed.
- On v0.15.0 the attacker also replaced checksums.txt so published hashes matched the new binaries.
- Homebrew, go install, source builds, and the Docker image are described as not exposed.
- The only published swapped hash is the v0.15.0 Linux arm64 archive, SHA-256 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb.
- OVHcloud founder Octave Klaba said affected users should change every secret stored on disk.
Impact: Steals secrets stored on disk of machines that run the swapped CLI
| Product | Affected | Fixed in |
|---|---|---|
| OVHcloud CLI | v0.11.0 through v0.15.0 | v0.16.0 |
- 1.If a swapped build may have run, rotate every secret readable on that machine from a different computer.
- 2.Remove the binary and install immutable OVHcloud CLI v0.16.0.
- 3.Verify a downloaded archive with gh release verify-asset v0.16.0.
- Vendors
- OVHcloud
- Products
- OVHcloud CLI
- Organizations
- GitHubOpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb | the v0.15.0 Linux arm64 archive: SHA-256 (swapped archive): 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb SHA-256 (original archive): 5c2beb56e6d83a4b426565a1557791e |
| sha256 | 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 | df8df648f4ec0bc4a75c176e28933cb SHA-256 (original archive): 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 A build without the version flag would report its version a |
From the original article
6 min read at thehackernews.com
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.