Hugging Face crypto-mining models return; a copy stays live
Original title: Hugging Face malware campaign returns to hijack GPUs for crypto mining
Pluto found 31 repositories posing as Qwen2 checkpoints; the flagship reached 28,412 downloads and a copy remained online.
Pluto Security found a cryptomining and backdoor campaign that uses Hugging Face repositories to ship Python through trust_remote_code. The models target GPU hosts running self-hosted servers such as Xinference and GPUStack. Loaded code can install a miner, open a reverse shell, and in one case break out of a container. Hugging Face and ModelScope removed a first wave, but 19 repositories reappeared within days. A near-identical htt0118/qwen2-tiny copy was still live. Separately, a fake Solana GitHub kit can lead coding agents to install NetSupport Manager.
Unconfirmed: Pluto attributes the campaign to a financially motivated Chinese-speaking operator; infections are not confirmed.
- MENXIANGYU/qwen2-tiny contained no real model and Hugging Face later disabled it.
- Linked repositories passed 32,000 downloads, which Pluto says are not confirmed infections.
- The operator’s main wallet received roughly $5,000 in Pearl and stayed active on pools.
- SolanaUpdateTools/solana-starter-kit, created in November 2025, has 286 stars and only a README.
- Its PowerShell step fetches NetSupport Manager configured for maxwintodaybtc[.]com.
Impact: GPU cryptomining, reverse shell, or hidden remote control
- 1.Treat machines that loaded these models with trust_remote_code enabled as compromised and rotate reachable credentials.
- 2.Check affected hosts against Pluto’s indicators; killing the miner does not remove backdoors.
- 3.Do not run the Solana starter kit README’s PowerShell installation command.
- ATT&CK
- T1496 Resource HijackingT1059.006 PythonT1611 Escape to HostT1059.001 PowerShellT1219 Remote Access Software
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | developer-update.app | command prompt. The Windows-only command assembles a URL on developer-update[.]app from fragments, then fetches and runs a script from it in |
| domain | maxwintodaybtc.com | , a legitimate remote-access tool, configured to connect to maxwintodaybtc[.]com and give the attacker hidden control of the machine at ev |
From the original article
4 min read at bleepingcomputer.com
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]
By Ax Sharma · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.