Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: OVHcloud CLI users
Incident: Hijacking of GitHub release archives to distribute secret-stealing malware.
Impact: Potential theft of local secrets and credentials from developer and server environments.
Attacker: GlassWorm (inferred)
Analysis: Attackers leveraged a hijacked GitHub contributor account to replace binaries in five previous CLI releases. The malware targeted local secrets stored on the disks of machines running the tool. The window of exposure was approximately 94 minutes, primarily affecting users utilizing installation scripts or manual downloads that lacked hash verification.
Recommendations: Update OVHcloud CLI to v0.16.0 or newer immediately.; Rotate all secrets and API keys stored on machines that ran the CLI during the compromise window.; Implement pinned SHA-256 hashes for all third-party binary downloads in CI/CD pipelines.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source