OVHcloud GitHub Compromise Reveals GlassWorm Activity

OVHcloud GitHub Compromise Linked to GlassWorm

OVHcloud’s GitHub account was accessed by actors linked to the GlassWorm threat group, resulting in credential theft and malicious code injection into private repositories. The breach was first identified on Oct 18, 2026, and publicly disclosed on Oct 21, 2026.

Attack Path and Exposure

1. Initial Access – Attackers gained entry through compromised GitHub credentials that had been stored in the OVHcloud account. The credentials were likely obtained via phishing or credential stuffing, though the exact vector remains unconfirmed.
2. Privilege Escalation – Once inside, the actors elevated their privileges by exploiting misconfigured repository permissions. They accessed private repositories that contained build scripts and deployment configurations.
3. Code Injection – The attackers inserted malicious code into the build pipeline. The injected code could exfiltrate data or provide a foothold for further lateral movement.
4. Credential Exfiltration – Sensitive tokens and keys were extracted from the repository secrets and sent to the attackers’ command-and-control infrastructure.

The exposure includes any code, secrets, or deployment artifacts stored in the affected repositories. If the compromised repositories were used to deploy services to production, the risk extends to those services.

Evidence

• GitHub Logs – Anomalous login events and repository modifications were recorded in the GitHub audit logs.
• Code Changes – Commit history shows unauthorized changes to build scripts and configuration files.
• Secret Dump – A list of extracted tokens and keys was recovered from the attackers’ staging environment.

The evidence was compiled by OVHcloud’s security team and corroborated by Dark Reading’s investigation.

Attribution

The activity is attributed to the GlassWorm threat group, a known actor that has targeted cloud infrastructure and CI/CD pipelines in the past. Attribution is based on malware signatures, command-and-control domains, and the similarity of the attack pattern to previous GlassWorm campaigns.

Immediate Mitigation Steps

1. Rotate Credentials – Immediately revoke all GitHub tokens, SSH keys, and passwords associated with the OVHcloud account.
2. Audit Repository Permissions – Verify that only authorized users have access to private repositories. Apply the principle of least privilege.
3. Review Build Pipelines – Inspect all CI/CD workflows for unauthorized changes. Revert any commits that were not approved by the development team.
4. Enable Two-Factor Authentication – Enforce 2FA for all GitHub accounts that have access to sensitive repositories.
5. Deploy GitHub Security Updates – Apply the latest GitHub security patches and enable security alerts for new vulnerabilities.
6. Monitor for Re-occurrence – Set up continuous monitoring of GitHub audit logs and alert on anomalous activity.

Long-Term Recommendations

• Implement Secret Management – Store secrets in a dedicated vault rather than in repository secrets.
• Use GitHub Advanced Security – Enable code scanning, secret scanning, and dependency review to detect malicious changes early.
• Conduct Regular Penetration Tests – Test repository access controls and CI/CD pipeline integrity.
• Educate Developers – Provide training on phishing awareness and secure coding practices.

Sponsored Placement

Appboard application listings

FAQ Snippets

What is the timeline of the OVHcloud GitHub compromise?

The compromise was first detected on Oct 18, 2026, and publicly disclosed on Oct 21, 2026.

Which threat actor group is linked to the attack?

The activity is attributed to the GlassWorm threat group.

How can I verify if my GitHub repositories are affected?

Check the GitHub audit logs for unauthorized login events and repository modifications. Look for commits that were not made by known developers.

What specific GitHub security updates should I apply?

Apply the latest GitHub security patches and enable security alerts for new vulnerabilities. Use the Zero-Day Vulnerability & CVE Exploit Matrix to track relevant CVEs.

Is there a risk to other cloud services?

If the compromised repositories were used to deploy services to production, those services may be at risk. Review deployment logs and verify that no unauthorized code was executed.

Related coverage

• GhostAction GitHub Actions Credential-Stealing Workflows Planted in 34,000+ Repositories
• AI Insider Threat: Enterprise AI Agents Slip Through Visibility Gaps

Explore more on this topic

• More cloud security coverage