OVHcloud GitHub account compromise linked to GlassWorm activity

A GitHub account associated with an OVHcloud developer has been identified as the vehicle for a malicious code distribution campaign. According to reports, the account was compromised several months prior to being utilized to push malicious files to unsuspecting users.

The incident has been attributed to the threat actor group known as GlassWorm. By gaining unauthorized access to the developer’s repository, the attackers were able to inject malicious code into projects, potentially exposing downstream users to security risks.

This development highlights the ongoing security challenges posed by supply chain attacks, where compromised developer credentials serve as a primary vector for distributing malicious software through trusted platforms. Further details regarding the scope of the compromise and specific mitigations remain limited as the situation is reviewed.

Source: Dark Reading
Original article: https://www.darkreading.com/cyberattacks-data-breaches/ovhcloud-github-compromise-glassworm-threat-actors