Hugging Face malware campaign returns to hijack GPUs for crypto mining

What it is

Pluto Security found 31 malicious Hugging Face repositories across seven accounts, published in two waves since September. They pose as small Qwen2 test checkpoints and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. The most downloaded, MENXIANGYU/qwen2-tiny, contains no model at all. A second, unrelated finding from Air Security covers a fake GitHub repository, SolanaUpdateTools/solana-starter-kit, aimed at AI coding agents.

How it works

The campaign uses no poisoned weights or pickle exploits. It relies on the trust_remote_code option, which lets a model ship its own Python code that runs as soon as the model loads. The code installs a miner disguised as a Linux system process, restarts it if killed, and removes competing miners. Some versions also open a reverse shell. A model published hours after Pluto's report carried a script that can break out of a container and take over the host underneath.

The Solana repository holds only a README. Its sole install step is a Windows PowerShell one-liner that builds a URL on developer-update[.]app from fragments and runs the fetched script in memory. The payload installs NetSupport Manager, configured to connect to maxwintodaybtc[.]com and give hidden control at every login. It then shows a fake "try again in 72 hours" error, which an agent could relay as a routine outage.

Preconditions / Affected

• Hugging Face: a user or service loaded one of these models with trust_remote_code enabled. Self-hosted inference on GPU hosts is the stated target.
• Solana kit: a Windows machine where an agent or developer follows the README and runs the command.
• The 32,000+ download figure counts downloads, not confirmed infections.

What to do

Pluto's advice for anyone who loaded these models with trust_remote_code on:

• Treat the machine as compromised.
• Check it against the indicators in Pluto's report.
• Rotate any credentials the machine could reach.
• Do not stop at killing the miner, because that does not remove the backdoors.

For the Solana kit, keep agents from running unreviewed shell one-liners taken from README files. The page gives no further commands.

Caveats

• Hugging Face scans with antivirus and partner tools from Protect AI and JFrog. Pluto says these look for known malware and unsafe formats, not what a model's Python code does. The flagship scanned clean at 28,412 downloads, though JFrog reported the payload file was "not a machine-learning model".
• Takedown is incomplete. Second-wave repositories were still live eight days after Pluto's report. A near-identical copy uploaded on October 25 by the account htt0118 was still live, and BleepingComputer confirmed it has the same miner and reverse shell.
• Pluto says the operator's main wallet has received roughly $5,000 in Pearl (PRL) and was still active on mining pools after removals. Nine machines that appear to be a shared research GPU cluster mined for about six minutes before dropping off.
• Pluto attributes the campaign to a financially motivated, Chinese-speaking operator, citing Simplified Chinese code comments, Alibaba Cloud command servers and late-night China activity hours.
• The Solana payload URL returned a 404 when Air checked, but the repository (286 stars, created November 2025) was still live. BleepingComputer retrieved the payload from the Wayback Machine. Air links the setup to a NetSupport RAT operator tracked by eSentire.