[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNbzxvYXSyq1y1HuEvj_WQdxqAx1FJnp5noTQeue5xLk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"f8e153ba-82c8-4d7e-9121-adf87d97034e","ovhcloud-cli-poisoned-via-github-release-swap-stealing-credentials-for-94-minutes","0924b834-4635-4dde-b09e-d1720d03591e","OVHcloud CLI Poisoned via GitHub Release Swap, Stealing Credentials for 94 Minutes","An attacker who had compromised an OVHcloud contributor's GitHub account swapped legitimate CLI release binaries with malicious ones containing a credential stealer, remaining undetected for 94 minutes and infecting roughly 250 users. The root cause is a combination of weak account security on a trusted contributor's identity and an absence of binary integrity verification in the release pipeline. This matters because developers and AI agents implicitly trust official release assets, making a tampered binary a high-yield, low-noise attack vector. The 94-minute detection gap demonstrates that without automated release integrity monitoring, supply chain substitutions can achieve significant reach before any alert fires.","**Immediate actions:**\n- Revoke and rotate all credentials associated with the compromised contributor account and audit all recent GitHub Actions and release activity from that account.\n- Publish cryptographic checksums (SHA-256) and GPG-signed manifests for every release asset and communicate the verification steps prominently to users.\n- Notify all ~250 affected downloaders and provide a credential-rotation runbook for cloud CLIs and configuration files targeted by the stealer.\n\n**Long-term improvements:**\n- Enforce mandatory MFA (preferably hardware security keys) on every GitHub account that has write or release permissions to the organization's repositories.\n- Implement a signed-release pipeline (e.g., Sigstore\u002Fcosign) so that no binary reaches the GitHub Releases page without a cryptographic attestation tied to a protected CI\u002FCD identity.\n- Apply least-privilege branch and release protection rules so that a single contributor account cannot publish a release without a secondary approval step.\n\n**Detection measures:**\n- Deploy automated binary-diffing or hash-comparison checks that alert within minutes whenever a release asset is replaced or updated outside of a defined CI\u002FCD workflow.\n- Integrate GitHub audit-log streaming into a SIEM with alerting on unexpected release-asset upload events, especially outside business hours or from unfamiliar IP ranges.",[12,13,14,15,16,17,18],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates supply chain security measures for essential and important entities; the failure to protect the integrity of a published software artifact and the downstream impact on users is precisely the scenario this article is designed to prevent.","Initial account access traced back to March 2026 is consistent with credential phishing or session-token theft; this technique maps directly to ATT&CK T1566 and underscores the need for phishing-resistant authentication on developer accounts.","SI-2 requires organizations to identify, report, and correct information system flaws, which extends to ensuring software distributed to users is authentic and untampered—a control that would mandate checksum verification on every release.","The 94-minute detection gap highlights the absence of a pre-planned, automated incident response playbook for supply chain compromise events; a defined procedure would have triggered faster containment and user notification.","Release assets should be continuously validated for integrity; automated scanning of published binaries against known-good hashes would have flagged the swapped binary within the release pipeline itself.","This control requires organizations to manage vulnerabilities in their software supply chain; a formal process for securing the release pipeline and verifying artifact integrity would fall directly under its scope.","The attacker gained initial access through a compromised contributor account; enforcing phishing-resistant MFA and strong identity controls on privileged GitHub accounts would have blocked or significantly raised the bar for this takeover.","published","2026-10-24T08:20:28.890225+00:00","2026-10-24T08:20:28.866+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fovhcloud-cli-github-release-swap-glassworm","ovhcloud-cli-compromised-via-github-release-swap-detonating-the-real-glassworm-l-840021","OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"80b83d8a-5131-4bae-8cfb-ef99c475f4cb","2026-10-24","afternoon","ThreatNoir Weekend Brief — October 24","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-24\u002Fthreatnoir-afternoon-brief-2026-10-24.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]