Hugging Face malware campaign returns to mine cryptocurrency on GPUs

A malware campaign targeting Hugging Face model repositories returned within days of its first takedown, according to security researchers at Pluto Security. The researchers found 31 malicious repositories across seven accounts, published in two waves since September. With linked models included, the repositories recorded more than 32,000 downloads; Pluto cautioned that downloads do not confirm infections.

The repositories posed as small Qwen2 test checkpoints targeting GPU hosts running self-hosted inference servers such as Xinference and GPUStack. They used Hugging Face’s trust_remote_code option, which runs a model’s Python code on a user’s machine when enabled. The most-downloaded model, MENXIANGYU/qwen2-tiny, contained no model, but installed a cryptocurrency miner disguised as a Linux system process. Some versions also opened a reverse shell for remote access.

After Hugging Face and ModelScope removed the first wave, 19 repositories appeared under new accounts within days. Pluto said a second-wave flagship model was still live eight days after it reported the repositories. Its downloads rose from 7,354 at the time of the report to 28,412 by October 28. Hugging Face has since disabled that model, but Pluto said a near-identical copy uploaded on October 25 remained available.

Separately, Air Security flagged a GitHub repository posing as a Solana starter kit. Its README directs users to run a PowerShell command that downloads a script and installs NetSupport Manager, configured to give an attacker hidden remote access. BleepingComputer said it confirmed the payload. The repository was still live at the time of reporting.