Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
The vulnerability or weakness
The vulnerability was not a specific flaw in the software but rather the lack of hash verification during installation, allowing the attacker to replace the download archives.
Earlier attacks and coverage
- Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (2026-10-20)
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic (2026-10-19)
Business impact
Organizations using the affected version of the CLI risked data breaches and potential legal ramifications, impacting their operations and reputation. The incident highlights the importance of verifying software integrity.
Industries affected
Cloud services, IT infrastructure, and cybersecurity firms are particularly affected, as they rely on such tools for managing cloud resources.
Users affected
Users who installed or updated the CLI during the specified window could have their systems compromised, leading to potential data theft or other malicious activities.
Build these skills
Sources
- Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (The Hacker News)
- OVHcloud CLI releases backdoored on GitHub to steal developer secrets (BleepingComputer)
