Hugging Face Malware Campaign Returns to Mine GPUs as Fake Solana Kit Targets AI Agents
Summary
Researchers report renewed Hugging Face models deploying cryptominers and backdoors, plus a fake Solana starter kit that tricks AI coding agents into installing NetSupport Manager for attacker access.
Key points
- Pluto Security found 31 malicious repositories across seven Hugging Face accounts; linked models had more than 32,000 downloads, which do not indicate confirmed infections.
- When loaded with `trust_remote_code` enabled, the models run Python code that can install a persistent cryptocurrency miner; some versions also open a reverse shell.
- A near-identical copy of the flagship model was still live when reported, while the original model had been disabled.
- Air Security says a fake Solana starter-kit README instructs users to run a PowerShell command that downloads and executes a script from developer-update[.]app.
- The analyzed payload installs NetSupport Manager configured to connect to maxwintodaybtc[.]com; the repository remained live, though the payload URL returned a 404 when Air checked.
- People who loaded the models with `trust_remote_code` enabled are advised to treat their machines as compromised, check indicators, and rotate reachable credentials; removing the miner alone does not remove backdoors.
Article Details
- Event Type
- Malware and cryptomining campaigns abusing AI model repositories and a GitHub repository targeting AI coding agents
- Impact
- Malicious Hugging Face models ran code when loaded with trust_remote_code enabled, installing a cryptocurrency miner and, in some versions, a reverse shell; one later script could escape a container. Pluto reported that the flagship model had 28,412 downloads, which does not establish infections. A separate PowerShell payload linked to a fake Solana starter kit installed NetSupport Manager configured for hidden remote access. Hugging Face disabled the reported flagship model, but a near-identical copy and the GitHub repository were still live at the time of writing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | developer-update[.]app | Domain used by the fake Solana starter kit's PowerShell command to retrieve and run the malicious payload. |
| DOMAIN | maxwintodaybtc[.]com | Domain the maliciously configured NetSupport Manager installation was set to connect to for attacker access. |
MITRE ATT&CK
T1059.001 · PowerShellThe fake Solana starter kit instructed users to run a PowerShell command that fetched and executed a script.T1105 · Ingress Tool TransferThe PowerShell command fetched a script from developer-update[.]app and ran it in memory.T1219 · Remote Access ToolsThe payload installed NetSupport Manager configured to provide the attacker hidden remote access.T1496 · Resource HijackingThe malicious model code installed a cryptocurrency miner that used infected machines' GPU resources.
Vendors
Alibaba CloudIt cites Simplified Chinese code comments, command-and-control servers on Alibaba Cloud, and activity times that fall late at night in China.GitHubSeparately, researchers flagged a fake Solana starter kit on GitHub, live since late 2025, that is positioned to trick AI coding agents into installing a remote access trojan.Hugging FaceHugging Face malware campaign returns to hijack GPUs for crypto miningJFrogHugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog.ModelScopeIt reported the first wave to Hugging Face and China's ModelScope, and both removed the accounts.Protect AIHugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog.
Products
GPUStackThey target GPU hosts running self-hosted inference servers such as Xinference and GPUStack.NetSupport ManagerThe payload installs NetSupport Manager, a legitimate remote-access tool, configured to connect to maxwintodaybtc[.]com and give the attacker hidden control of the machine at every login.Qwen2The models pose as small Qwen2 test checkpoints.xinferenceThey target GPU hosts running self-hosted inference servers such as Xinference and GPUStack.