Executive Summary
On October 19, 2026, the Glassworm threat actor group executed a supply chain attack against OVHcloud by hijacking the GitHub account of a legitimate contributor (`HassenBF`). The attackers replaced release binaries for versions v0.11.0 through v0.15.0 of the official OVHcloud CLI with malicious builds designed to harvest developer credentials and cloud secrets. The malicious files were available for approximately 94 minutes before being identified and removed by OVHcloud.
Technical analysis reveals that the compromised account had been under attacker control since at least March 2026, evidenced by a series of 'amend-and-force-push' actions on personal repositories to inject a hidden JavaScript loader. The malware uses an obfuscated loader that decodes payloads from the Solana blockchain via a specific wallet memo field (`BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC`), a hallmark of the ForceMemo campaign. This technique allows the operator to update C2 infrastructure without modifying the source code.
This incident highlights critical risks in the software supply chain, specifically the danger of mutable release assets and the lack of binary provenance. Organizations using the OVHcloud CLI on macOS, Linux, or Windows that updated during the brief window are advised to treat all secrets stored on those machines as compromised and perform immediate rotation.