Malware campaign hijacks Hugging Face models to mine cryptocurrency

Pluto Research has tracked an active campaign active on Hugging Face and ModelScope that hijacks GPU servers by abusing open-weight model repositories. The attacker exploits the trust_remote_code parameter in Python Transformers, causing attacker code to run before model weights load. Across September and October 2026, researchers identified 31 malicious model repositories across seven accounts, with 13 linked models and more than 32,000 downloads.

A second wave followed within days, including a repository named MENXIANGYU/qwen2-tiny that alone accumulated 28,412 downloads by late October. The operation appears financially motivated, with confirmed technical ties among the 31 repositories via shared staging URLs, backup files and mining credentials; the campaign also uses Alibaba Cloud for command infrastructure and references to ModelScope and hf-mirror[.]com.

The activity period shows peaks between 18:38 and 21:19 UTC, aligning with late-night hours in China Standard Time, and some Indonesian-language comments suggest a possible collaborator or test.

Infection chains target self-hosted inference platforms such as Xinference and GPUStack, as well as shared notebooks and CI pipelines. The attacker packages mimic small Qwen2 checkpoints, but the safetensors payload contains only 42 bytes; a configuration file uses auto_map to point to a malicious Python script loaded during model import. The script drops a watchdog at /tmp/.cch/svc.py, injects startup commands into .bashrc and .profile, and establishes a reconciling reverse shell to an external IP.

A memory-only loader then fetches a packed binary, disables Python proxy handlers, writes the binary to a memfd, and executes it as a kernel worker disguise. The payload, a peakminer cryptocurrency miner, connects to Kryptex pools to mine Pearl PRL, with about 2,276 PRL reported across 716 transactions. Defence guidance calls for auditing for /tmp/.cch directories, unauthorized svc.py processes, and suspicious kworker/u20:1 entries, plus manual review of trust_remote_code usage and isolated container workloads.