GoKawiilCrypto-mining malware reappears on Hugging Face days after takedown
Researchers at Pluto Security identified 31 malicious model repositories across seven Hugging Face accounts, disguised as Qwen2 test checkpoints, that abuse the platform's trust_remote_code feature to run attacker-supplied Python code when a model loads. The most-downloaded fake model, with no real weights inside, installed a disguised cryptocurrency miner and in some cases opened a reverse shell; after Hugging Face and ModelScope removed the first wave of accounts, 19 new repositories appeared within days, including one with code able to break out of its container.
GoKawiil's interpretation of the reporting above, not reported fact.
The rapid reappearance suggests attackers can cheaply spin up new accounts faster than platforms can police them, undermining the value of takedowns alone. Pluto Security's finding that downloads exceed 32,000 indicates the technique of hiding executable code inside a trusted model-loading option could be reused widely against GPU-hosting developers who enable trust_remote_code without scrutiny. A separate fake Solana starter kit on GitHub, designed to fool AI coding agents into installing a remote access trojan, points to a broader pattern of attackers targeting developer and AI tooling supply chains.
- Pluto Security found 31 malicious Hugging Face repos across 7 accounts disguised as Qwen2 test models.
- The campaign exploits trust_remote_code to auto-run attacker code and install hidden cryptominers and reverse shells.
- New malicious accounts reappeared within days of takedown, with one model capable of container breakout.
Source: bleepingcomputer.com, 2026-10-29
Published there as: “Hugging Face malware campaign returns to hijack GPUs for crypto mining”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.