OVHcloud CLI: How to Detect & Block GlassWorm Supply Chain Attack

Executive Summary

On October 19, 2026, leading European cloud provider OVHcloud suffered a targeted software supply chain compromise after threat actors attributed to the GlassWorm group hijacked a developer's GitHub account. Operating with legitimate maintainer permissions, the adversary weaponized a critical configuration gap—disabled release immutability—to directly overwrite compiled binary distributions on five historical releases of the official OVHcloud Command-Line Interface (CLI) tool.

The substituted releases (v0.11.0 through v0.15.0) were replaced with weaponized binaries compiled for macOS, Linux, and Windows containing an embedded secret-stealing payload. The trojanized CLI harvested developer disk artifacts, including cloud configuration profiles, AWS/GCP/OVHcloud API tokens, SSH private keys, shell histories, and .env environment files.

Crucially, because the threat actor injected the trojanized executables directly into existing GitHub Releases via API, the tampering bypassed all internal CI/CD build pipelines, automated GitHub Actions testing, security linters, and branch protection rules. The tampered assets remained publicly available on GitHub for 94 minutes (from 12:47 UTC to 14:21 UTC) before being revoked following an alert from a vigilant customer. OVHcloud responded by removing the malicious assets, locking release immutability, and publishing clean version v0.16.0.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The OVHcloud CLI incident exposes an increasingly prevalent blind spot in modern DevOps security: treating GitHub Releases as immutable artifact repositories when release mutability has not been explicitly enforced.

[ GlassWorm Threat Actor ]
           │
           │ 1. Compromises Developer GitHub Account (PAT / OAuth Token / Credentials)
           ▼
[ GitHub SaaS API Endpoint ] (api.github.com/repos/ovh/ovh-cli/releases)
           │
           │ 2. Releases Immutability Disabled -> Direct Asset Overwrite via REST API
           ▼
[ Historical Official Releases (v0.11.0 to v0.15.0) ]
           ├── macOS Build (arm64 / x86_64) -> Injected Secret Stealer
           ├── Linux Build (amd64 / arm64)   -> Injected Secret Stealer
           └── Windows Build (x64)           -> Injected Secret Stealer
           │
           │ [ CI/CD Completely Bypassed: Git commits, tags, and PRs untouched! ]
           ▼
[ Developer Workstation Download ] (Window: Oct 19, 12:47 - 14:21 UTC)
           │
           │ 3. Developer executes ovh-cli command
           ▼
[ Local Disk Credential Harvesting ]
           ├── ~/.ssh/id_rsa, ~/.ssh/id_ed25519
           ├── ~/.aws/credentials, ~/.config/gcloud
           ├── ~/.ovh/ovh.conf, local .env files
           └── Exfiltration to GlassWorm C2

1. Developer Identity Compromise & SaaS Lateral Movement

GlassWorm actors obtained valid authentication material belonging to an authorized OVHcloud repository maintainer. Rather than attempting to penetrate OVHcloud's corporate internal network or tamper with internal build servers (Jenkins, GitLab CI, or self-hosted runners), the adversary operated entirely within the public GitHub cloud platform using the developer's credentials.

2. The Mutability Flaw in GitHub Releases

By default on many historical repositories, GitHub allows maintainers with write permissions to delete, replace, or upload new compiled binary assets to existing releases.

• In this attack, GlassWorm did not push new git commits, modify source files, or alter git tags.
• Consequently, Branch Protection Rules, CODEOWNERS review policies, and automated GitHub Actions security scanners (CodeQL, Dependabot, Trivy) were never triggered.
• The adversary used the GitHub Releases API (POST /repos/{owner}/{repo}/releases/{release_id}/assets) to silently substitute the compiled binary assets on releases dating back multiple versions (v0.11.0 through v0.15.0).

3. Multi-OS Trojan Payload Execution

The trojanized CLI wrapper retained the authentic command-line syntax and operational interface of the genuine tool, preventing immediate user suspicion. In the background, however, the binary initiated multi-threaded credential harvesting:

• Cloud Provider Credentials: Enumerates ~/.aws/credentials, ~/.config/gcloud/, and ~/.ovh/ovh.conf.
• Cryptographic Keys: Scans user home directories for SSH private keys (id_rsa, id_ed25519, known_hosts).
• Environment & Secret Files: Recursively scans working directories for files matching *.env, *.pem, *.key, and *token*.
• Exfiltration: Encrypts and transmits harvested secrets via HTTPS POST requests directly to adversary-controlled command-and-control servers.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile: GlassWorm

GlassWorm is an advanced cyber espionage and software supply-chain threat actor group characterized by precise targeting of developer infrastructure:

• Modus Operandi: Specializes in developer identity hijacking, package registry poisoning (npm, PyPI), and abusing permissive repository management settings.
• Objective: Upstream credential harvesting to enable downstream lateral movement into high-value cloud infrastructure and enterprise software vendors.
• Speed & Agility: Demonstrates rapid weaponization and asset swapping; upon obtaining developer tokens, GlassWorm executed simultaneous multi-OS binary uploads across five version tags in under ten minutes.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Organizations whose developers utilize the OVHcloud CLI must execute the following four-step remediation protocol immediately:

Step 1: Audit Local Installations & Remove Tampered Binaries

Identify if any developer workstation downloaded or updated the OVHcloud CLI on October 19, 2026:

# 1. Check current installed CLI version
ovh-cli --version

# 2. Inspect file modification timestamp of the CLI binary
# Linux / macOS:
stat $(which ovh-cli)

# 3. If installed between Oct 19, 12:47 UTC and Oct 19, 14:21 UTC, remove immediately:
sudo rm -f $(which ovh-cli)

# 4. Install verified clean release v0.16.0
curl -sSL https://github.com/ovh/ovh-cli/releases/download/v0.16.0/ovh-cli_Linux_x86_64.tar.gz | tar -xz
sudo mv ovh-cli /usr/local/bin/

Step 2: Enforce GitHub Release Immutability

DevOps administrators across all enterprise GitHub organizations must enforce Release Immutability:

1. In the GitHub repository, navigate to Settings > General > Releases.
2. Enable Enforce release immutability. Once enabled, published release assets cannot be deleted or overwritten by maintainers, blocking direct binary injection.
3. Require release assets to be generated and signed exclusively via GitHub Actions with OIDC provenance (SLSA Level 3).

Step 3: Mandatory Enterprise Secret & Token Rotation

If an affected binary was executed, treat all credentials stored on that machine as compromised:

• Cloud Providers: Rotate all OVHcloud API Application Keys, AWS IAM Access Keys, and GCP Service Account keys.
• SSH Infrastructure: Revoke all SSH public keys associated with local private keys and replace authorized_keys entries across production servers.
• Git & CI/CD: Invalidate all GitHub Personal Access Tokens (PATs) and developer SSH signing keys.

---

2. Network & Perimeter Defenses

1. Egress Firewall Rules: Audit outbound connections from developer endpoints on October 19 for anomalous HTTPS POST requests to unclassified foreign IP addresses.
2. Artifact Verification in CI/CD: Implement automated checksum validation in developer setup scripts. Ensure scripts downloading CLI tools verify the package against published SHA-256 sums rather than downloading blindly from /latest URLs.

---

3. Endpoint Detection & Hunting Query

Validated Sigma Rule (YAML)

Detects suspicious credential harvesting patterns executed by CLI binaries accessing sensitive configuration directories:

title: Suspicious Developer Credential Access by CLI Binary
id: c7104b92-5e19-482a-a940-128a50cf419b
status: test
description: Detects CLI binaries reading multiple sensitive developer credential stores (SSH keys, cloud config, .env files) in rapid succession.
references:
    - https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
date: 2026/10/21
logsource:
    category: file_access
    product: linux
detection:
    initiating_process:
        Image|endswith:
            - '/ovh-cli'
            - '/ovh'
    target_files:
        TargetFilename|contains:
            - '/.ssh/id_'
            - '/.aws/credentials'
            - '/.config/gcloud/'
            - '/.ovh/ovh.conf'
            - '/.env'
    condition: initiating_process and target_files
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.supply_chain

Microsoft Sentinel / Defender KQL Hunting Query

Search for processes executing from user download directories accessing sensitive credential repositories:

DeviceFileEvents
| where InitiatingProcessFileName =~ "ovh-cli" or InitiatingProcessFileName =~ "ovh-cli.exe"
| where ActionType == "FileRead" or ActionType == "FileAccessed"
| where FolderPath has_any (".ssh", ".aws", ".azure", ".config/gcloud", ".env")
| project
    TimeGenerated,
    DeviceId,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    FolderPath,
    FileName,
    AccountName
| order by TimeGenerated desc

Splunk (SPL) Hunting Query

Hunt for anomalous network egress originating from developer CLI processes:

index=endpoint (process_name="ovh-cli" OR process_name="ovh-cli.exe") event_type="network_connection"
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(dest_ip) as destination_ips by host, user, process_path
| where NOT cidrmatch("198.27.64.0/18", dest_ip) AND NOT cidrmatch("51.254.0.0/15", dest_ip)
| convert ctime(first_seen) ctime(last_seen)
| sort - count

---

(Note: OVHcloud removed the tampered assets within 94 minutes; defenders should audit file creation timestamps and execute the credential rotation protocol above.)