Hijacked OVHcloud tool briefly turned developer updates into credential theft risk
Attackers linked to the Glassworm group pushed five malicious versions of OVHcloud’s official command‑line tool on 19 October, leaving users who downloaded or updated it during a 94‑minute window at risk of having their access keys and other secrets stolen.
A short‑lived compromise of a popular cloud management tool has left developers and system administrators checking whether their machines quietly handed over the keys to their infrastructure.
On 19 October, threat actors linked to a group known as Glassworm broke into the release process for OVHcloud’s official command‑line interface (CLI) and published five tampered versions, according to security researchers. OVHcloud is one of Europe’s largest cloud providers, and its CLI is widely used to control servers, storage and networking from a terminal.
The malicious builds were available for up to 94 minutes on GitHub and on Homebrew, a common package manager for macOS, before being removed. Anyone who installed or updated the OVHcloud CLI during that window may have executed attacker‑controlled code on their computer without realizing it.
Investigators say the altered binaries were built to steal sensitive information from infected machines. In practice, that includes cloud access keys, tokens used to talk to online services, private keys used for secure connections and other credentials that developers often keep on their workstations.
Once exposed, those secrets can give intruders a way into production servers, databases or even other cloud environments. A single stolen access key can be enough to copy customer data, delete backups or change running applications.
This attack fits a broader trend: instead of going after hardened data centers directly, attackers are compromising the trusted tools that administrators use every day. Command‑line utilities, browser add‑ons and software libraries have all become high‑value targets because they sit close to the point where code and infrastructure meet.
For organizations, the immediate task is to identify who may have installed the OVHcloud CLI during the compromised period, assume that those users’ credentials could be exposed, and rotate keys, tokens and passwords. Logs linked to those accounts need to be checked for unusual activity, and in some cases systems may have to be rebuilt from clean images.
Customers and regulators will now look to OVHcloud for a detailed explanation of how the attackers reached its release pipeline and what extra safeguards will be put in place. Security teams will also be watching for signs that Glassworm is trying the same technique against other vendors and for any intrusions traced back to secrets stolen during this window.
Sources
- OSINT