OVHcloud CLI Hijacked: 94 Minutes of Secret-Stealing Malware

Michael Miller · 2026-10-20

Imagine downloading a trusted tool from GitHub, only to have it silently steal your secrets. That's exactly what happened with OVHcloud's command-line tool last Monday, October 19. An attacker hijacked a contributor's GitHub account and replaced the download archives on five existing releases with malware designed to steal sensitive data from your disk. The malicious files were live for up to 94 minutes, from 12:47 to 14:21 UTC. If you grabbed the tool during that window, your secrets might be compromised. ### How the Attack Unfolded OVHcloud, a major cloud provider, maintains a CLI tool that developers use to manage their services. The attacker didn't need to find a sophisticated zero-day or break into OVHcloud's core infrastructure. Instead, they took the path of least resistance: a contributor's GitHub account. Once inside, they swapped the legitimate download archives with a malicious build. This build, according to OVHcloud, was specifically crafted to steal secrets stored on the disk of any machine that ran it. We're talking about API keys, passwords, tokens—the keys to your digital kingdom. The compromise was discovered quickly, but not quickly enough. For 94 minutes, anyone who downloaded the tool from those five releases got more than they bargained for. OVHcloud has since removed the malicious files, but the incident raises serious questions about supply chain security. ### The 94-Minute Window: What You Need to Know The timeline is tight but critical: from 12:47 to 14:21 UTC on October 19. If you downloaded or updated OVHcloud's CLI during that period, you should assume your system is compromised. The malware was designed to exfiltrate secrets, so any credentials stored on your disk could be in the hands of the attacker. OVHcloud recommends rotating all credentials and scanning affected machines immediately. > "Supply chain attacks like this are a wake-up call. Trust in open-source repositories is essential, but verification is non-negotiable." — Michael Miller, Lead Antidetect Browser Strategist & Architect ### Why This Matters for Antidetect Browser Users If you're using antidetect browsers to manage multiple online identities, this incident hits close to home. Antidetect browsers rely on a complex ecosystem of tools, extensions, and scripts—many of which are downloaded from public repositories. A compromised tool can undermine even the most sophisticated setup. Imagine spending hours perfecting your browser fingerprints, only to have a single malicious update leak your real identity. That's the nightmare scenario. This attack also highlights the importance of isolation. When you run a tool that has access to your disk, it can read everything—including the secrets stored by your antidetect browser. That's why security experts recommend running untrusted tools in sandboxes or virtual machines. But even then, a determined attacker can find a way out. ### Lessons Learned: Securing Your Workflow So, what can you do to protect yourself? Here are a few practical steps: - **Verify checksums:** Always check the integrity of downloaded files against official checksums. - **Use isolated environments:** Run tools in containers or VMs to limit damage. - **Monitor accounts:** Enable two-factor authentication and monitor for suspicious activity on all accounts, especially those with write access to repositories. - **Rotate credentials regularly:** Especially after any suspected breach. OVHcloud has promised a full post-mortem, but the damage is done. The attacker may have gained access to sensitive data from numerous users. As always, vigilance is your best defense. ### The Bigger Picture This isn't the first supply chain attack, and it won't be the last. From SolarWinds to Codecov, attackers are increasingly targeting the tools we trust. The OVHcloud incident is a reminder that even reputable providers can be compromised through third-party accounts. For professionals in the antidetect browser space, where anonymity is paramount, every download is a potential risk. Stay safe out there. And the next time you download a tool, take a moment to verify—it might just save your secrets.