Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI
Summary
Researchers have discovered that a developer's account was compromised and used to inject a stealer malware into the OVHcloud Command Line Interface (CLI). The compromise reportedly occurred in March and was associated with a GlassWorm-linked loader.
IFF Assessment
FOE
The compromise of a developer account leading to the injection of malware into a legitimate software tool is a significant security incident that undermines trust and potentially exposes users to data theft.
Defender Context
This incident highlights the critical importance of securing developer accounts and implementing robust supply chain security measures. Defenders should be vigilant for signs of compromised software artifacts and ensure their systems are protected against information-stealing malware.