Hugging Face Crypto-Mining Malware Campaign Returns
A sophisticated malware campaign abusing Hugging Face models to hijack GPU servers for cryptocurrency mining has resurfaced just days after being taken down by platforms, while researchers separately exposed a malicious GitHub repository targeting AI coding agents.
Radwan AbdulhadiEditor and technology writer
Resurgences of Hugging Face Cryptomining Malware
A cryptomining and backdoor campaign that abuses Hugging Face model repositories has quickly returned within days of being taken down. According to research detailed by Pluto notes, the financially motivated campaign utilizes malicious repositories that pose as small Qwen2 test checkpoints.
The campaign specifically targets GPU hosts running self-hosted inference servers. Security researchers uncovered 31 malicious repositories across seven Hugging Face accounts published in two waves since September, accumulating more than 32,000 total downloads when including linked models.
Exploiting trust_remote_code for GPU Hijacking
Rather than relying on poisoned weights or pickle exploits, the campaign abuses a native Hugging Face configuration option known as trust_remote_code. This setting allows a model to ship its own custom Python code, which executes automatically on the user's machine as soon as the model is loaded.
The campaign's flagship model, MENXIANGYU/qwen2-tiny, contained no actual machine-learning model at all. Instead, its underlying code quietly installs a cryptocurrency miner disguised as a Linux system process, automatically restarts it if killed, and removes competing miners from the host machine.
Certain versions of the payload also open a reverse shell, giving the threat actor direct access to the compromised server. The campaign targets popular self-hosted setups such as Xinference and GPUStack.
Evasion and Continued Threat Activity
After Pluto Security reported the initial wave to Hugging Face and China's ModelScope, both platforms removed the offending accounts. However, a second wave of 19 repositories appeared under new accounts within days.
Security analysts noted that Hugging Face automatically scans uploads with antivirus engines and partner tools from Protect AI and JFrog. However, these security scanners primarily check for known malware signatures and unsafe model formats rather than analyzing what a model's custom Python code actually executes.
By October 28, downloads of the flagship malicious model climbed past 28,412. While Hugging Face subsequently disabled access to that specific model, near-identical copies uploaded by newer accounts remained active, continuing to distribute the same miner and reverse shell payloads.
Separate GitHub Campaign Targets AI Coding Agents
In a separate security development, Air Security describes a malicious GitHub repository positioned to trick AI coding agents into installing remote access malware. The repository ranks as a top search result when AI coding tools look for a Solana starter kit.
The fake starter kit provides no actual application code inside its repository files. Instead, its README file instructs users—or an automated AI coding assistant following the documentation—to execute a PowerShell one-liner that downloads and runs an in-memory script.
The retrieved script installs the NetSupport Manager remote access trojan, granting the attacker hidden, persistent control over the infected machine at every login while displaying a fake error message to mask the malicious activity.
Recommendations for Affected Infrastructure
Security researchers emphasize that organizations and developers who loaded the malicious models with trust_remote_code enabled must treat their machines as completely compromised. Remediation requires checking hosts against indicators of compromise provided in security advisories and rotating any credentials that the infected servers could reach, as simply terminating the miner process does not remove the installed backdoors.
Sources
- BleepingComputerHugging Face malware campaign returns to hijack GPUs for crypto mining
Continue chronologically
Related entity coverage
Related stories
Building Custom AI Models Using ML Intern
Discover how developers are leveraging HuggingChat with ML Intern to autonomously plan, train, evaluate, and publish custom open-source AI models.
AI Engineer Compiles 32-Bit RISC-V CPU Into Qwen LLM Weights
An AI engineer has successfully compiled a 32-bit RISC-V CPU directly into the weights of the Qwen 3.5 4B large language model, enabling it to run C code and DOOM.
PoeLLM Cryptomining Malware Hits Over 3,400 Servers
Researchers reveal a cryptomining malware campaign named Canto Incognito has infected over 3,400 servers, utilizing a GitHub poem to locate C2 servers.
OVHcloud CLI Releases Backdoored on GitHub to Steal Secrets
OVHcloud warns users that attackers compromised its open-source CLI repository on GitHub to distribute information-stealing malware.
