Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining

Security researchers have reported a recurring malware campaign abusing Hugging Face model repositories to deploy cryptocurrency miners and backdoors on self-hosted GPU infrastructure. This activity highlights emerging supply-chain risks targeting machine learning workflows and AI development tools.

According to findings published by Pluto Security, malicious actors published 31 repositories across seven Hugging Face accounts in two distinct waves starting in September. The campaign relies on the `trust_remote_code` configuration option, which permits models to execute custom Python code upon loading. Instead of utilizing traditional pickle exploits or poisoned weights, the affected repositories contained scripts designed to quietly install cryptocurrency miners, remove competing payloads, and in some instances, open reverse shells to grant unauthorized server access.

Key Details and Findings

• Target Infrastructure: Self-hosted inference servers running frameworks like Xinference and GPUStack.
• Download Metrics: The flagship malicious model accumulated over 28,000 downloads before access was disabled, though researchers note that download counts do not equal confirmed infections.
• Attribution Indicators: Pluto Security attributes the operation to a financially motivated, Chinese-speaking threat actor, citing Simplified Chinese code comments, command-and-control servers hosted on Alibaba Cloud, and activity timestamps aligned with late-night hours in China.

Separate GitHub Threat Targeting AI Agents

In a separate advisory, Air Security detailed a malicious GitHub repository (`SolanaUpdateTools/solana-starter-kit`) active since late 2025. The repository reportedly targets AI coding agents by providing a README file with instructions that prompt the execution of a PowerShell script. This script fetches and runs an in-memory payload that installs NetSupport Manager, a remote-access tool configured to provide persistent attacker access.

Practical Implications and Verification

Organizations utilizing self-hosted AI models or automated coding agents should review their security postures:

• Audit Configurations: Verify whether models are loaded with `trust_remote_code` enabled.
• Check Indicators: Compare system processes and network logs against indicators of compromise published in the original security reports.
• Rotate Credentials: Treat any machine that loaded suspected repositories as compromised and rotate accessible credentials.

To verify original disclosures, consult the security advisories published directly by Pluto Security and Air Security, or review platform-specific repository status updates.