StepSecurity14 days ago

OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an orphaned commit, and detonated the full chain in an isolated chamber. The replay shows

Published October 24, 2026 · 4:21 PM
An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an orphaned commit, and detonated the full chain in an isolated chamber. The replay shows
Read

Source: StepSecurity

Ask AI about this articleBeta

The AI only has access to this article — it won't make up facts. Try:

AI can be wrong. Cross-check before sharing.

Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake