Hugging Face Malware Campaign Returns Days After Takedown to Hijack GPU Servers for Crypto Mining

Researchers at Pluto Security have documented a malicious campaign on Hugging Face that abuses model repositories to hijack GPU servers for cryptocurrency mining and plant backdoors, and which returned within days of being taken down. The firm found 31 malicious repositories across seven accounts, published in two waves since September. The models pose as small Qwen2 test checkpoints and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. Including linked models, the repositories have accumulated more than 32,000 downloads, though Pluto notes this counts downloads rather than confirmed infections. Rather than relying on poisoned weights or pickle exploits, the campaign abuses Hugging Face's trust_remote_code option, which allows a model to ship its own Python code. When a user enables that option, the code executes on their machine as soon as the model loads. The most downloaded model, MENXIANGYU/qwen2-tiny, contained no actual model at all. Its embedded code quietly installs a cryptocurrency miner disguised as a Linux system process, restarts it if killed, and removes competing miners from the machine. Some versions also open a reverse shell, giving the attacker direct access to the infected server. Pluto discovered the campaign through a test account whose leftover backup files pointed to the attacker's main accounts. It reported the first wave to Hugging Face and China's ModelScope, and both platforms removed the accounts. A second wave of 19 repositories appeared under new accounts within days. Hours after Pluto reported the new activity, the operator published another model carrying a script capable of breaking out of a container and taking over the underlying server. According to Pluto, the second-wave repositories were still live eight days after it reported them. Downloads of the flagship model climbed from 7,354 at the time of the report to 28,412 by October 28. As of writing, Hugging Face has disabled access to that model, but a near-identical copy uploaded on October 25 by a newer account, htt0118, remains live. BleepingComputer confirmed it contains the same miner and reverse shell. Hugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog, but Pluto says these checks look for known malware and unsafe model formats rather than analyzing what a model's Python code actually does. "The second-wave flagship scanned clean while it collected 28,412 downloads," the researchers said, adding that JFrog reported the payload file was "not a machine-learning model." Pluto attributes the campaign to a financially motivated, Chinese-speaking operator, citing Simplified Chinese code comments, command-and-control servers on Alibaba Cloud, and activity occurring late at night in China's time zone. The operator's main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency and remained active on mining pools after the repositories behind it were removed. While the researchers were observing, nine machines that appear to belong to a shared research GPU cluster began mining for the operator simultaneously, dropping off about six minutes later, which Pluto says fits an administrator killing the jobs. Pluto advises that anyone who loaded these models with trust_remote_code enabled should treat the machine as compromised, check it against the indicators in the firm's report, and rotate any credentials the machine could reach. Killing the miner alone does not remove the backdoors. In a separate report, Air Security describes a GitHub repository, SolanaUpdateTools/solana-starter-kit, that it says ranks as the top result when AI coding agents search for a Solana starter kit. The repository was created in November 2025 and has 286 stars. Its README promises a full Solana app template, but none of that code exists, and the README is the repository's only file. An agent that selects the repository and follows its README could execute the attacker's command without the developer ever seeing it. The README's only installation step instructs users to paste a PowerShell one-liner into a command prompt. The Windows-only command assembles a URL on developer-update[.]app from fragments, then fetches and runs a script from it in memory. BleepingComputer obtained the archived payload from the Internet Archive's Wayback Machine and confirmed Air's findings. The payload installs NetSupport Manager, a legitimate remote access tool, configured to connect to maxwintodaybtc[.]com and give the attacker hidden control of the machine at every login. The script then displays a fake error claiming developer functionality is temporarily paused due to load and telling the user to try again in 72 hours, a message an AI agent could easily relay as a routine server issue. Air linked the setup to a known NetSupport RAT operator tracked by eSentire, and to an earlier campaign that lured cryptocurrency traders with fake TradingView AI signal tools. The payload URL returned a 404 when Air checked, but the GitHub repository remained live at the time of writing.