Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]

Pluto Security Shows Why Hugging Face Scanners Cleared a Live Malware Campaign

The most uncomfortable finding in Pluto Security‘s research is not only that malware reached a major AI model hub. It is that the hub’s scanning looked at the malware and found nothing wrong. None of the 12 first-wave repositories was flagged, and the second-wave flagship scanned clean while it collected 18,012 downloads. What the Hub […]

‘It is a feature’: how a Hugging Face model download runs malware

The trick at the center of this campaign is not an exploit. It is a feature. Pluto Security’s analysis of a cryptominer operation on the Hugging Face Hub shows that the attacker never needed to break anything. The model-loading library runs the Python that infects a machine exactly as designed. Three doors, one left open […] This story continues at The Next Web

Pluto Security Uncovers Self-Iterating Cryptominer Campaign Hidden in Hugging Face AI Models

A financially motivated operator or small group has been using the Hugging Face Hub since September 2026 to distribute cryptocurrency miners and backdoors disguised as small Qwen2 language models, according to a report shared by Pluto Security. The campaign has run through two waves and more than 40 code iterations across 28 repositories. Its second wave remained live as of October 25, five days after Pluto Security reported it. Downloads across…