Fake AI Models Turned Hugging Face Into a Mining Trap

AI model repositories became malware delivery systems. On October 29, 2026, Pluto Security published its Load/Mine report, detailing a cryptomining and backdoor campaign spread through malicious Hugging Face repositories. The campaign also reached ModelScope through a mirror, turning ordinary-looking model downloads into a route for code execution, persistence and cryptocurrency mining.

Pluto counted 31 malicious repositories across seven Hugging Face accounts, with 29,818 campaign downloads. Including 13 linked repositories, the total reaches 32,376 — although Pluto states that these figures measure downloads, not confirmed infections or unique victims.

The campaign returned within days of an initial takedown. Nineteen second-wave repositories recorded more than 29,000 downloads and remained live eight days after Pluto reported them, while the most popular fake model reached 18,012 downloads by October 25 and stayed available five days after it was reported. Platform scanning did not catch the first wave: all 12 repositories escaped with zero security flags.

The Loading Feature Was the Attack Surface

The attackers did not need to poison model weights. They relied on documented behavior in Transformers, activated when a repository loads with trust_remote_code=True — a setting that imports repository Python code with the caller’s privileges before any weights load.

A repository’s config.json uses auto_map to identify the Python module and class that Transformers should load. Transformers downloads the referenced file into its module cache, then the exec_module() call runs the file’s top-level code before returning the requested model class. That is documented behavior, not the default, but the security policy tells users to verify modeling files before using the argument.

The fake models imitated Qwen2 and used deliberately plain names such as qwen2-tiny and qwen2-mini. One repository copied the official Qwen2.5-0.5B model description word for word, while the most downloaded model replaced the supposed data file with a 42-byte stand-in containing nothing useful. The model was mostly camouflage. A classic tech industry move: make the packaging look respectable and let the payload handle the rest.

Pluto also cites CVE-2026-22807, which affected vLLM versions from 0.10.1 up to the fix in 0.14.0. Those versions loaded auto_map modules without checking the trust_remote_code setting, allowing a malicious repository to run code when the server started.

Backups Exposed the Campaign’s Linkages

Pluto built a scanner that checked every .py file referenced by auto_map in a config.json, along with Python files stored beside model weights. It searched for patterns including subprocess, socket, ctypes, memfd_create and base64 decoding.

The first hit was dsxk4mr8tq/qwen2-tiny-gpt2, an account holding six repositories created within 2.5 hours on October 12, 2026. The attribution break came from backup files in qwen2-tiny-lite: modeling_evil.py.bak-src and modeling_evil.py.bak-sync preserved older versions of the same malware.

According to the report, the operator copied production code into a test account, changed the URLs in the main file and forgot the backups. Those files linked Hugging Face account target hhzz667 and ModelScope target wssb123e, helping Pluto connect repositories that were otherwise presented as separate projects.

Wave one covered 12 repositories across three accounts and two platforms, with more than 700 downloads recorded before removal. Pluto counted more than 40 versions of the code, suggesting a maintained operation rather than a single disposable upload.

Mining Was Only Part of the Payload

Using MENXIANGYU/qwen2-tiny as a representative build, Pluto describes a payload that first writes /tmp/.cch/svc.py. A watchdog restarts a missing miner every 120 seconds, while launch hooks are added to /root/.bashrc, /root/.profile and the user’s .bashrc.

Three builds also add a reverse shell connecting to 212.32.253.3 on port 443. One second-wave payload collects cloud metadata and GPU details, expanding the campaign from resource theft into access and environment discovery.

Pluto assessed the operation as financially motivated and linked to a Chinese-speaking operator or small group. The assessment rests on Simplified Chinese comments in the code, Alibaba Cloud hosting, the attacker’s chosen mirrors and the systems targeted.

Blockchain records show the first-wave wallet received about 2,276 PRL, worth roughly $5,000, in on-chain mining proceeds. The wallet was still earning after the fake models were removed, and deleting the model or killing the miner does not remove the hidden access left behind.

Pluto advises pinning the version reviewed and running untrusted code with limited privileges, restricted network access and no production secrets. Anyone who believes they were hit should remove the hidden access from a clean machine, then replace passwords, keys and cloud credentials — deleting the miner alone is the cybersecurity equivalent of hiding the evidence under the rug.

Stay connected via Google News

Follow us for the latest AI News