step-security · Crawled Nov 1, 2026

OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found

16 IoCs 1 Malware
Read original article ↗

AI Summary

On October 19, 2026, an attacker compromised the GitHub account HassenBF, a legitimate OVHcloud contributor, and replaced binaries in five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious version containing the GlassWorm credential stealer. The malicious binaries were live for 94 minutes, downloaded approximately 250 times, and exfiltrated sensitive files including cloud credentials, SSH keys, and AI agent tokens to an endpoint at 45.32.148.174. The attack leveraged a previously compromised developer machine via a malicious VS Code extension, and the payload was delivered through a trojanized release binary that bypassed checksum verification due to swapped hashes. The attacker used a local Go build without proper version flags, leaving a detectable fingerprint via the 'ovhcloud version' command. The malicious activity was detected by a customer using pinned SHA-256 hashes in CI, leading to rapid remediation and release of a clean, immutable, attested v0.16.0 version.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware GlassWorm →

Indicators of Compromise 16 extracted

Type Value Detail
IP 45[.]32[.]148[.]174 Details →
IP 162[.]33[.]177[.]177 Details →
SHA-256 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb Details →
MD5 6f2f086239f3d88eb2750e871901927d Details →
MD5 347e65eb7f2d78d1c6872690272a6cc3 Details →
MD5 301bff0b51980b9e76c93633e7cfd3bd Details →
MD5 6a3cf153338c4161697cda2fe704c884 Details →
SHA-256 43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70 Details →
SHA-256 0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c Details →
Filename preinstall.js Details →
Filename /tmp/envchecker-* Details →
Filename ~/init.json Details →
GitHub Repo HassenBF/next-dashboard Details →
GitHub User HassenBF Details →
Registry User HassenBF Details →
SHA-1 5ead8ef9b43d354dfb5caadff803b11afc8c5c58 Details →

MITRE ATT&CK TTPs 31 techniques

T1003 OS Credential Dumping · Credential Access T1013 T1013 T1021.001 Remote Desktop Protocol · Lateral Movement T1021.003 Distributed Component Object Model · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1059.007 JavaScript · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1078.001 Default Accounts · Defense Evasion T1078.002 Domain Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1086 T1086 T1090 Proxy · Command And Control T1102.001 Dead Drop Resolver · Command And Control T1105 Ingress Tool Transfer · Command And Control T1136.001 Local Account · Persistence T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1195.002 Compromise Software Supply Chain · Initial Access T1218.011 Rundll32 · Defense Evasion T1548.001 Setuid and Setgid · Privilege Escalation T1548.002 Bypass User Account Control · Privilege Escalation T1555 Credentials from Password Stores · Credential Access T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access T1614.001 System Language Discovery · Discovery