--- title: Hugging Face malware campaign returns to hijack GPUs for... description: A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of a takedown. Researchers at Pluto Security found 31... canonical: https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hugging Face malware campaign returns to hijack GPUs for crypto mining | daily.dev og:description: A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of a takedown. Researchers at Pluto Security found 31... og:url: https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth og:image: https://api.daily.dev/og/posts/PxeJ1zhTH.png og:image:alt: Hugging Face malware campaign returns to hijack GPUs for crypto mining og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hugging Face malware campaign returns to hijack GPUs for crypto mining **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of a takedown. Researchers at Pluto Security found 31 malicious repositories across seven accounts, published in two waves since September. The campaign abuses the 'trust_remote_code' option, which lets a model run its own Python code on load. The top model, MENXIANGYU/qwen2-tiny, contained no real model and instead installed a disguised cryptominer and sometimes a reverse shell; its downloads climbed to 28,412 and the operator's wallet received roughly $5,000 in Pearl (PRL). Separately, Air Security found a fake GitHub Solana starter kit, live since November 2025 with 286 stars, that tricks AI coding agents into running a PowerShell one-liner that installs the NetSupport RAT. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is trust_remote_code in Hugging Face and why is it a security risk? It's a Hugging Face option that lets a model ship its own Python code, which runs automatically on a user's machine as soon as the model loads if the option is enabled. Attackers exploited this in a campaign where a fake Qwen2 checkpoint, MENXIANGYU/qwen2-tiny, contained no real model at all, only code that installed a disguised cryptocurrency miner and, in some versions, a reverse shell. _Developers vetting model repos before enabling that flag can track emerging supply chain risks on daily.dev._ ### How are attackers using fake GitHub repos to compromise AI coding agents? A fake Solana starter kit repository, SolanaUpdateTools/solana-starter-kit, ranked as a top result when AI coding agents searched for Solana templates, despite having no real code, only a README. Its only install step is a PowerShell one-liner that fetches and runs a script installing NetSupport Manager, a legitimate remote-access tool reconfigured to give an attacker hidden control at every login, connecting to maxwintodaybtc[.]com. _Teams letting coding agents fetch and run dependencies can follow new supply chain tricks like this on daily.dev._ ### Can Hugging Face's malware scanning catch malicious trust_remote_code models? No, Hugging Face scans uploads with antivirus tools and partner scanners from Protect AI and JFrog, but these look for known malware signatures and unsafe model formats rather than analyzing what a model's bundled Python code actually does. One malicious flagship model scanned clean while accumulating 28,412 downloads, even though JFrog flagged its payload file as 'not a machine-learning model.' _Anyone relying on platform scans before pulling models can stay current on these blind spots via daily.dev._ ## Similar posts on daily.dev - [Malicious Hugging Face model masquerading as OpenAI release hits 244K downloads](https://daily.dev/posts/malicious-hugging-face-model-masquerading-as-openai-release-hits-244k-downloads-xftpmcpz1) · CSO Online · 0 upvotes · 0 comments - [Pluto Security details how a trust\_remote\_code download turns into malware](https://daily.dev/posts/pluto-security-details-how-a-trust-remote-code-download-turns-into-malware-sndx2vogo) · The Next Web · 0 upvotes · 0 comments - [Fake OpenAI repository on Hugging Face pushes infostealer malware](https://daily.dev/posts/fake-openai-repository-on-hugging-face-pushes-infostealer-malware-cakkzapb4) · BleepingComputer · 8 upvotes · 0 comments - [Hugging Face Hack Lessons for Cyber Defenders](https://daily.dev/posts/hugging-face-hack-lessons-for-cyber-defenders-z3vltbx1w) · Dark Reading · 0 upvotes · 0 comments - [Hugging Face and ClawHub compromised with hundreds of malicious AI models and agent skills as supply chain attacks target AI infrastructure](https://daily.dev/posts/hugging-face-and-clawhub-compromised-with-hundreds-of-malicious-ai-models-and-agent-skills-as-supply-xjnujrk1y) · The Next Web · 4 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#github](https://daily.dev/tags/github) [View this post on daily.dev](https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hugging Face malware campaign returns to hijack GPUs for crypto mining","url":"https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth"},"datePublished":"2026-10-29T22:11:50.409Z","dateModified":"2026-10-29T23:22:48.296Z","description":"A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of a takedown. Researchers at Pluto Security found 31...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6b91e208695e2d8b4109da323c32dd4b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6b91e208695e2d8b4109da323c32dd4b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,ai-agents,github","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hugging Face malware campaign returns to hijack GPUs for crypto mining"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-pxej1zhth#faq","mainEntity":[{"@type":"Question","name":"What is trust_remote_code in Hugging Face and why is it a security risk?","acceptedAnswer":{"@type":"Answer","text":"It's a Hugging Face option that lets a model ship its own Python code, which runs automatically on a user's machine as soon as the model loads if the option is enabled. Attackers exploited this in a campaign where a fake Qwen2 checkpoint, MENXIANGYU/qwen2-tiny, contained no real model at all, only code that installed a disguised cryptocurrency miner and, in some versions, a reverse shell. Developers vetting model repos before enabling that flag can track emerging supply chain risks on daily.dev."}},{"@type":"Question","name":"How are attackers using fake GitHub repos to compromise AI coding agents?","acceptedAnswer":{"@type":"Answer","text":"A fake Solana starter kit repository, SolanaUpdateTools/solana-starter-kit, ranked as a top result when AI coding agents searched for Solana templates, despite having no real code, only a README. Its only install step is a PowerShell one-liner that fetches and runs a script installing NetSupport Manager, a legitimate remote-access tool reconfigured to give an attacker hidden control at every login, connecting to maxwintodaybtc[.]com. Teams letting coding agents fetch and run dependencies can follow new supply chain tricks like this on daily.dev."}},{"@type":"Question","name":"Can Hugging Face's malware scanning catch malicious trust_remote_code models?","acceptedAnswer":{"@type":"Answer","text":"No, Hugging Face scans uploads with antivirus tools and partner scanners from Protect AI and JFrog, but these look for known malware signatures and unsafe model formats rather than analyzing what a model's bundled Python code actually does. One malicious flagship model scanned clean while accumulating 28,412 downloads, even though JFrog flagged its payload file as 'not a machine-learning model.' Anyone relying on platform scans before pulling models can stay current on these blind spots via daily.dev."}}]} ```