A cryptocurrency mining campaign has resurfaced on Hugging Face shortly after its earlier accounts were removed, using fake artificial intelligence models to take control of computing resources.
Cybersecurity researchers identified dozens of malicious repositories designed to run hidden mining software and, in some cases, provide attackers remote access to servers. A separate operation on GitHub has also been found targeting AI coding agents with a deceptive cryptocurrency development kit.
How Were the Malicious Models Distributed?
Researchers at Pluto Security identified 31 malicious repositories across seven Hugging Face accounts, published in two waves since September 2026.
The files were presented as small Qwen2 test models intended for systems running self-hosted AI services, including Xinference and GPUStack. Together, the repositories recorded more than 32,000 downloads. Researchers stressed that download figures do not establish how many machines were actually infected.
The most popular malicious model alone exceeded 28,000 downloads.
How Did the Attackers Hijack GPUs?
The campaign exploited an option called `trust_remote_code`, which permits a model to execute its own Python code when loaded by a user.
One widely downloaded repository contained no functional AI model. Instead, its code installed a cryptocurrency miner disguised as a Linux process.
The malware was designed to restart if terminated and remove competing mining software. Certain versions also opened a reverse shell, potentially giving attackers direct access to compromised servers.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Researchers warned that deleting the miner would not necessarily eliminate the additional access mechanisms.
Why Did the Campaign Return After Removal?
Pluto Security alerted Hugging Face and ModelScope to the initial accounts, which were subsequently removed.
Within days, another 19 repositories appeared under different accounts. Researchers also observed the operator publishing fresh versions after further reports.
The leading model’s downloads rose from 7,354 to 28,412 by October 28. A closely matching copy was still accessible when examined.
The researchers linked the operation to a financially motivated, Chinese-speaking attacker and estimated that the main cryptocurrency wallet had received roughly $5,000 in Pearl tokens.
What Was the Separate GitHub Threat?
In a separate investigation, Air Security identified a fake Solana starter kit on GitHub that could mislead AI coding assistants searching for a development template. The repository, created in November 2025, had 286 stars but contained no promised application code. Its instructions instead directed users to run a Windows PowerShell command.
That command installed NetSupport Manager, a legitimate remote-access program configured to give the attacker hidden access when the machine started. The script then displayed a misleading technical error, potentially concealing the installation.
What Should AI Developers Know?
The findings illustrate two distinct risks: running untrusted code embedded in downloadable AI models and allowing coding assistants to follow unverified repository instructions.
Anyone who loaded the affected models with remote code enabled should consider the server potentially compromised, investigate for persistence mechanisms and rotate credentials that might have been exposed.
The420 Insight
AI development platforms can be abused to distribute malicious software disguised as useful tools. Download counts, familiar hosting services and convincing project descriptions cannot replace careful verification before executing external code.
