OVHcloud GitHub account used to ship malicious CLI binaries
Poisoned ovhcloud-cli releases were online for 1 hour 33 minutes and downloaded about 250 times.
Stories per day · 30 days
3 RSS
8 stories, newest first · one card per story
Stories tagged #glassworm
Info-stealer slipped into OVHcloud CLI GitHub releases
Tampered builds v0.11.0 through v0.15.0 were live for under two hours on October 19; v0.16.0 is clean.
1
Hijacked developer account planted a stealer in OVHcloud CLI
Releases v0.11.0 through v0.15.0 were replaced for about 94 minutes on October 19; v0.16.0 is clean.
1
OVHcloud CLI releases 0.11.0–0.15.0 backdoored on GitHub to steal secrets
A hijacked GitHub account pushed trojanized binaries for about 90 minutes on October 19; 0.10.0 and 0.16.0 are clean.
1
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
A ThreatsDay roundup covers GlassWorm VS Code themes, VulcanRAT207, a Qilin extradition, and a rogue Gentlemen affiliate.
GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware
GlassWorm-linked VS Code theme extensions hide downloaders that fetch Windows malware, including a blockchain-addressed in-memory loader.
GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes
GlassWorm-linked malicious VS Code color themes on Visual Studio Marketplace and Open VSX shipped staged JavaScript loaders that pulled C2 addresses from Solana memos.
8
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.
5