Attackers resurface Hugging Face GPU cryptojacking campaign after takedown

A cryptojacking campaign targeting GPU servers on Hugging Face came back within days of a prior takedown, with attackers publishing 31 malicious repositories across seven accounts in two waves beginning in September 2026.

The flagship malicious model, MENXIANGYU/qwen2-tiny, had been downloaded 28,412+ times as of Oct. 28, 2026, even though it had been reported to Hugging Face on Oct. 20, 2026. The model contained no actual model data and instead installed cryptocurrency mining malware and reverse shells on GPU servers. A second-wave model, htt0118/qwen2-tiny, remained live on Oct. 29, 2026, under one of 19 new-account repositories despite being reported.

Pluto Security says a financially motivated, Chinese-speaking operator runs the campaign, citing Simplified Chinese code comments, Alibaba Cloud command servers, and activity timing that matched late-night hours in China. One wave-two build also included Indonesian-language comments, suggesting possible redundancy or a second operator.

The malware drops a cryptocurrency miner that poses as a Linux system process, restarts itself when killed, and removes competing miners so it can use the GPU itself. Some variants also open a reverse shell that lets attackers reach the server directly. Persistence comes from SSH keys and cron jobs, plus startup hooks and a watchdog process that relaunches the miner after it stops. Stopping the miner by itself does not remove the backdoors or the exposed credentials.

The campaign aims at GPU servers that run self-hosted inference tools such as Xinference and GPUStack, exploiting trust_remote_code, which lets models run custom Python code during loading, to run malicious Python code before a model loads. The attacker’s code executes with the user’s privileges, which permits deep system compromise.

The operator’s main cryptocurrency wallet took in roughly $5,000 in Pearl (PRL) from mining, and 2,276 PRL of that came from the first wave alone. Nine servers inside a shared research cluster mined together for the attacker before shutdown, and mining continued even after takedowns, pointing to persistent backdoor access. The operator’s wallet remained active on mining pools after takedowns.

The second-wave payload contains a script that escapes containers by mounting host disks and granting root access to GPUStack’s /var/lib/gpustack directory. By bypassing container isolation, the script lets attackers compromise the host system.

Hugging Face’s malware scanning did not catch the malicious models because its antivirus tools detect only known malware signatures and unsafe formats, while bundled Python code goes unchecked. The second-wave flagship model scanned clean even though it accumulated 28,412 downloads, and JFrog had flagged it as not being a machine-learning model, confirming the scanning gap. Hugging Face’s ClamAV scanning has the same limitation.

Hugging Face’s security documentation tells users to check Python code before switching on trust_remote_code, since this feature runs arbitrary code with the user’s privileges. Checking auto_mapped files for subprocess, socket, or ctypes calls through a static scan might have blocked the campaign earlier.

Pluto Security advises rotating credentials, rebuilding infected systems from trusted images, and locking to reviewed model revisions to stop reinfection. It also said trust_remote_code should be disabled unless absolutely necessary.

Attackers rapidly adapted and republished malicious models after takedowns, a cycle the sources described as whack-a-mole. The sources pointed to runtime enforcement and egress controls as responses for AI infrastructure. The pattern held across both waves beginning in September 2026.

A separate supply-chain threat targeted AI coding agents through a fake Solana starter kit on GitHub. The repository, SolanaUpdateTools/solana-starter-kit, has been live since November 2025 and holds no real code, only a README page carrying malicious setup instructions that trick agents into installing the NetSupport RAT, a remote access trojan repurposed from the legitimate NetSupport Manager tool, through a PowerShell one-liner. The repository has 286 stars and ranks as a top search result even though it holds no legitimate code.

The NetSupport RAT payload reaches out to maxwintodaybtc[.]com, giving attackers hidden control at each login and showing a fake error to mislead users. When checked, the payload URL returned a 404, yet the GitHub repository is still live.

Hugging Face hosts and shares AI models, and trust_remote_code is a legitimate feature for advanced models that creates a security risk if abused. AI coding agents increasingly automate the fetching of dependencies, so they are prime targets for supply-chain attacks such as fake repositories. Cryptojacking campaigns use GPU resources to mine cryptocurrency without the user’s consent, which drives up cloud costs and degrades performance.