Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware

OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks.

CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47 and detected and blocked it by 16:21, creating a 94-minute exposure window.

The affected versions included v0.11.0, v0.12.0, v0.13.0, v0.14.0, and v0.15.0. Klaba assured that v0.10.0 and the upcoming v0.16.0 were not compromised.

OVHcloud GitHub Repository Compromised

According to The Stack, the attacker accessed an OVHcloud developer’s GitHub account and inserted a malicious binary into the CLI repository.

This utility helps customers manage the provider’s cloud services, making it a prime target for attackers seeking access to operational credentials.

“The hacker used a developer’s GitHub account to add a binary designed to retrieve secrets from the disk,” Klaba stated. He acknowledged that while the binary was poor quality, it still effectively fulfilled its malicious intent.

Initial checks by OVHcloud found no other affected repositories. However, the company is continuing to investigate how the developer account was compromised, which files the malware targeted, and whether it successfully exfiltrated data.

As it stands, the disclosure confirms the malicious distribution and secret-retrieving functionality. However, it does not provide a confirmed count of compromised customers or stolen credentials.

The customer report highlighted suspicious activity involving an account named HassenBF and raised concerns about a “dirty build.” The reporter noted that this account was not publicly recognized as an OVH organization member or a repository contributor.

However, they acknowledged that private membership could explain its absence. More importantly, the customer questioned changes to the release assets and asked for clarification on the legitimacy of the rebuild. They recommended treating published assets as immutable or issuing new versions instead of overwriting existing files.

The customer also mentioned switching to building through the module proxy. Because the repository did not have private vulnerability reporting enabled, they chose to raise their concerns publicly.

These observations helped uncover the incident but do not provide a complete picture of the attacker’s access or how the release was modified.

Klaba urged users who downloaded the affected CLI versions that day to update them immediately or delete them. “If you are affected, please change all the secrets stored on your disk,” he advised.

While replacing the executable mitigates the malicious software’s presence, OVHcloud also emphasized the importance of replacing credentials for a successful recovery.

This incident shows how a compromised maintainer account can turn a trusted software distribution channel into an attack vector, even when the repository appears legitimate to users downloading routine updates.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.