Cryptomining - GoKawiil

Crypto-mining malware reappears on Hugging Face days after takedown

Researchers at Pluto Security identified 31 malicious model repositories across seven Hugging Face accounts, disguised as Qwen2 test checkpoints, that abuse the platform's trust_remote_code feature to run attacker-supplied Python code when a model loads. The most-downloaded fake model, with no real weights inside, installed a disguised cryptocurrency miner and in some cases opened a reverse shell; after Hugging Face and ModelScope removed the first wave of accounts, 19 new repositories appeared within days, including one with code able to break out of its container.

bleepingcomputer.com · 2026-10-29

PoeLLM malware uses GitHub poem to control cryptomining botnet on 3,400 AI servers

Black Lotus Labs reports that a malware strain called PoeLLM has compromised more than 3,400 exposed AI servers, with up to 800 infected systems active on a single day. The malware, an ELF file named libgcrypt, derives its command-and-control IP address by extracting keywords from a poem hosted in a GitHub repository, updating the poem 11 times since April to rotate C2 addresses.

bleepingcomputer.com · 2026-10-07