Hugging Face mining campaign returns after model takedowns
A malware campaign using Hugging Face model repositories returned under new accounts within days of takedowns. Pluto Security traced 31 repositories across seven accounts, with linked models exceeding 32000 downloads. Repository-supplied Python can run before model weights load. The operation combines stolen graphics-processor capacity with backdoor access that can survive removal of the mining process.
Artificial Intelligence··Midday
New accounts follow the takedowns
A cryptomining campaign returned to Hugging Face, a platform for sharing artificial intelligence models, within days of its first accounts being removed.[1], [2]
The October 29 investigation by cybersecurity company Pluto Security followed 31 malicious repositories across seven accounts and two waves. The repositories resembled small Qwen2 test models. Their targets included self-hosted graphics processing unit servers, rented machines and shared research notebooks.[1]
Code runs before model weights load
The entry point was Python supplied with the repository, rather than poisoned model weights. Some models need custom implementations beyond the built-in support of the Transformers model-loading library. Repository code runs with the calling process’s privileges before the weights load when the user permits it. Pluto found miners and backdoors using this route. Checks of weight formats or known malware signatures do not cover all the accompanying code’s behavior.[1]
Downloads exceed 32000 across linked models
Hugging Face and ModelScope removed the first-wave accounts after notification. 4 new accounts then carried a second wave, whose 19 repositories exceeded 29000 downloads. Linked models lifted the total above 32000 downloads, rather than confirmed infections or unique victims. Pluto traced roughly 5000 dollars in payments to a first-wave wallet. Backdoor connections changed between waves, and previously installed access could persist after a repository or mining process was removed.[1]
