Hugging Face malware campaign returns to hijack GPUs for crypto mining

Summary

A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of takedown. Its most downloaded malicious model, MENXIANGYU/qwen2-tiny, contained no model at all, and its trust_remote_code Python code installed a disguised miner, restarted it if killed, removed competing miners, and in some versions opened a reverse shell. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT.

Topics

• Model and package supply chain

Related items

• HighCVE-2026-119120: Crawl4AI Docker API lets clients choose the HuggingFace model it loadsSame vendor · NVD/CVE Database
• InfoWe urgently need to monitor AI agents’ actions in real timeSame vendor · MIT Technology Review
• InfoA Shared Language for Agent Defense: Introducing Project QuarrySame vendor · Cisco AI Blog
• InfoSecrets Management Firm Infisical Valued at $600 Million After $40 Million RaiseSame vendor · SecurityWeek
• HighGHSA-wf6j-7hvr-gr93: Hydra legacy target blacklist permits unsafe PyYAML loadingSame vendor · Hugging Face Security Advisories