French cloud provider OVHcloud has alerted users that attackers compromised its open-source command-line interface tool to distribute malware designed to steal sensitive information. A threat actor gained access to a developer’s GitHub account and modified versions 0.11.0 through 0.15.0 of the CLI tool, which administrators and developers use to manage cloud services from a terminal. The company’s CEO reported that the compromised release appeared on October 19 and was detected and blocked within approximately two hours after a customer reported the issue. Older version 0.10.0 and the latest release 0.16.0 were unaffected by the breach.
OVHcloud has enabled GitHub’s release immutability feature to prevent similar incidents and considers the matter resolved. The company urges users who downloaded compromised versions to update or remove the tool and to revoke all secrets stored on their systems. Security researchers linked the attack to GlassWorm, a group known for targeting software development ecosystems including VSCode, OpenVSX, GitHub, and npm. The compromised GitHub account had been infiltrated for over six months, and the malware affected users on macOS, Linux, and Windows platforms, though source builds and Docker images remained clean.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
