Hugging Face crypto-mining campaign returns days after takedown

A cryptomining and backdoor campaign that abuses Hugging Face model repositories resumed just days after it was taken down. Its most popular malicious model was downloaded more than 28,000 times.

Code runs before the model loads

Researchers at Pluto Security found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September. The models pose as small Qwen2 test checkpoints and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. Counting linked models, the repositories have more than 32,000 downloads. Pluto stresses that these are downloads, not confirmed infections.

The attackers don't rely on poisoned weights or pickle exploits. Instead, they abuse a built-in option, trust_remote_code, which lets a model ship its own Python code. When a user enables it, that code runs as soon as the model loads.

The most downloaded model, MENXIANGYU/qwen2-tiny, contained no actual model at all. Its code quietly installs a cryptocurrency miner disguised as a Linux system process, restarts it if killed, and removes competing miners from the machine. Some versions also open a reverse shell, giving the attacker direct access to the server.

Back after the takedown

Pluto uncovered the campaign through a test account whose leftover backup files pointed to the attacker's main accounts. It reported the first wave to Hugging Face and China's ModelScope, and both removed the accounts. Within days, however, a second wave of 19 repositories appeared under new names. Hours after Pluto reported it, the operator published yet another model with a script that can break out of a container and take over the host server.

According to Pluto, the second-wave repositories were still live eight days after it reported them. Downloads of the flagship model climbed from 7,354 at the time of the report to 28,412 by October 28. Hugging Face has since disabled access to it, but a near-identical copy, htt0118/qwen2-tiny, uploaded on October 25, was still live at the time of writing. BleepingComputer confirmed it contains the same miner and reverse shell.

Clean scans, real payouts

Hugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog. Pluto says these look for known malware and unsafe model formats but do not analyze what the Python code actually does. The second-wave flagship scanned clean, even though JFrog noted the payload file was "not a machine-learning model."

The operator's main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency. While the researchers watched, nine machines that appear to belong to a shared research GPU cluster started mining for the attacker at once. They dropped off about six minutes later, which Pluto says fits an admin killing the jobs.

Pluto attributes the campaign to a financially motivated, Chinese-speaking operator. It cites Simplified Chinese code comments, command-and-control servers on Alibaba Cloud, and activity times that fall late at night in China. Anyone who loaded these models with trust_remote_code enabled should treat the machine as compromised and check it against the indicators in Pluto's report. They should also rotate any credentials the machine could reach. Killing the miner alone is not enough: the backdoors stay in place.

A fake Solana kit

In a separate report, Air Security describes a GitHub repository, SolanaUpdateTools/solana-starter-kit. According to Air, it ranks as the top result when AI coding agents search for a Solana starter kit. The repository was created in November 2025 and has 286 stars. Its only file is a README that promises a full app template. That file tells users to paste a PowerShell one-liner into a command prompt. The command assembles a URL on developer-update[.]app from fragments and runs the fetched script in memory. An agent following the README could run that command without the developer ever seeing it.

The script installs NetSupport Manager, a legitimate remote-access tool, configured to give the attacker hidden control at every login. It then shows a fake error asking the user to "try again in 72 hours," which an agent could easily relay as a routine glitch. Air links the setup to a known NetSupport RAT operator. The payload URL returned a 404 when checked, but the repository itself was still live at the time of writing.

Source: Bleeping Computer