Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
Summary
Hackers compromised a contributor's GitHub account and replaced download archives for five OVHcloud command-line tool releases with malware designed to steal secrets. The malicious files were available for up to 94 minutes before being discovered and removed by the cloud provider.
IFF Assessment
This incident highlights a sophisticated supply chain attack where attackers compromised legitimate software releases to distribute malware, posing a direct threat to users of the affected tools.
Defender Context
This incident is a prime example of a supply chain attack, where attackers leverage trusted software distribution channels to deliver malicious payloads. Defenders should be vigilant about verifying the integrity of software downloads, especially from open-source repositories, and implement robust endpoint detection and response (EDR) solutions to identify and mitigate the impact of secret-stealing malware.