Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

An attacker hijacked a contributor's GitHub account to compromise five existing releases of OVHcloud's command-line tool. The attacker replaced the download archives with malicious files designed to steal secrets from the disk of any machine that runs them. These tainted files were available on GitHub for a period of up to 94 minutes, between 12:47 and 14:21 UTC on October 19. The cloud provider has acknowledged the incident, which occurred after the contributor's account was taken over. The malicious files were a modified build of the command-line tool. The brief availability of the malicious files was between 12:47 and 14:21 UTC.