A cryptomining campaign on Hugging Face has returned days after a takedown, with the most popular malicious model climbing to 28,412 downloads by October 28. Pluto Security identified 31 malicious repositories across seven accounts, posing as small Qwen2 test checkpoints.
31 Malicious Repositories Across Two Waves
Pluto Security found the repositories in two waves since September. Counting linked models, they drew more than 32,000 downloads. The figure counts downloads, not confirmed infections.
The second wave arrived within days of the first takedown, with 19 repositories appearing under new accounts. The affected targets are Hugging Face model repositories and GPU hosts running Xinference and GPUStack.
The Flagship Model That Scanned Clean
The flagship model passed scanning. JFrog said the payload was “not a machine-learning model.” Its downloads grew from 7,354 to 28,412 by October 28. Hugging Face has since disabled it, but a near-identical copy uploaded October 25 by an account named htt0118 was still live and contained a miner and a reverse shell.
The Campaign Abuses Custom Code Loading, Not Model Weights
The operation does not rely on poisoned weights. It abuses Hugging Face’s custom code loading feature, trust_remote_code. A user who loads one of the models with that option enabled runs the attacker’s code on their machine.
Hours after Pluto’s report, the operator published a model containing a container-escape script, which shows the operator adapted in direct response to disclosure.
Nine Machines Mined Briefly on a Shared GPU Cluster
Pluto described one observed case in which nine machines of a shared research GPU cluster mined for about six minutes before stopping. The report does not explain why the mining stopped.
Pluto Attributes the Operation to a Chinese-Speaking Operator
Pluto attributes the campaign to a financially motivated, Chinese-speaking operator. Its evidence includes Simplified Chinese comments in the code, command-and-control infrastructure on Alibaba Cloud and activity during late-night hours in China. The main wallet received about $5,000 in Pearl (PRL), the cryptocurrency the miner targets.
Hugging Face Disables the Flagship Qwen2 Model
Hugging Face disabled the flagship model after the report. Because a near-identical copy stayed live, removal of one repository did not end the exposure. Anyone who loaded the models with trust_remote_code enabled faces possible GPU hijacking and server compromise, and the guidance reported is to treat affected machines as compromised.
A Separate Fake Solana Starter Kit Targets AI Coding Agents
The same reporting flagged an unrelated item: researchers found a fake Solana starter kit on GitHub, live since late 2025, aimed at tricking AI coding agents into installing a remote access trojan. The Hugging Face campaign and the GitHub kit are separate operations, linked in the coverage only by their focus on AI development workflows.
The Hugging Face campaign’s pattern is notable for its persistence. A first takedown did not stop the operator, who created new accounts within days, uploaded a near-identical copy of the flagship model and added a container-escape script after being named publicly. The download counts, at over 32,000 across all linked models and 28,412 for the flagship alone, indicate substantial reach, though Pluto cautions that downloads do not equal infections. The $5,000 received by the main wallet is a modest take relative to the reach, and the report does not say how many machines produced it.
Pluto Security’s Evidence Ties Both Waves to One Operator
The two waves share traits that Pluto uses to link them: Simplified Chinese comments in the code, command-and-control hosted on Alibaba Cloud and late-night China-hours activity. The first wave began in September, and the second followed within days of the takedown with 19 repositories under fresh accounts. Across both, the 31 repositories sit under seven accounts.
The htt0118 copy uploaded October 25 shows the operator kept publishing while the flagship model was still drawing downloads. That near-identical copy carried the same miner and reverse shell.
