OVHcloud CLI Releases Compromised on GitHub to Distribute Secret-Stealing Malware
Attacker leveraged hijacked contributor account to replace download archives; users at risk of credential theft
Key Takeaways
- Attacker used a hijacked GitHub contributor account to replace five OVHcloud CLI release archives.
- Malicious files were live on GitHub for up to 94 minutes (12:47 to 14:21 UTC) on October 19, 2026.
- The compromised builds were designed to steal secrets stored on the user's disk.
- OVHcloud has removed the malicious releases and restored legitimate versions.
Related Security News
ClickFix Attackers Exploit Siemens Software Center DLL Sideloading Flaw
Siemens has remediated a high-severity DLL sideloading vulnerability in Siemens Software Center that was exploited by ClickFix threat actors to deploy a Remote Access Trojan. The flaw, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, allowed execution of malicious code with application privileges. Patches have been released; users are advised to update to the latest version.
ROMULUS ClickFix Platform Exploited to Deliver LegionLoader and Secondary Malware
Researchers from Forescout - Vedere Labs have identified ROMULUS, a ClickFix-style malware delivery platform used by threat actors to distribute LegionLoader and other malware. The campaign employs bogus landing pages with deceptive lures that trick users into executing malicious commands, resulting in infection.
