Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Pluto Security experts discovered 31 malicious repositories, published through seven Hugging Face accounts. The campaign started in September 2026 and unfolded in two phases. The attackers masqueraded their creations as small Qwen2 test models and targeted server owners with GPUs running neural networks via Xinference and GPUStack.
For the infection they used the trust_remote_code parameter, which allows executing Python code supplied with the model. If the user enabled this feature, the malicious program started before the neural network itself was loaded. No specific vulnerabilities were required for the attack. It was enough to trust code execution from an unknown author.
The most popular repository, MENXIANGYU/qwen2-tiny, did not contain a real model at all. Instead it held a script that installed a cryptocurrency miner, disguised it as a Linux system process, and automatically restarted it after a crash. The program also removed competing miners and some versions opened a remote command shell for remote access.
The first wave was detected thanks to backup files accidentally left in a test account of the attacker. After the reports, Hugging Face and the Chinese platform ModelScope removed the associated accounts. However, a few days later another 19 repositories appeared. Subsequently, the attacker released a variant with a script capable of escaping the container and taking control of the main server.
The removed model MENXIANGYU/qwen2-tiny reached 28,412 downloads by October 28. However, Hugging Face’s automated checks did not flag the threat. The scanners Protect AI and JFrog looked for known malware and dangerous file formats, but they did not detect the malicious behavior of the Python code. Experts caution separately that the download count does not equal the number of infected servers.
The attack yielded real profits. According to Pluto Security’s assessment, the attacker’s main wallet received about $5,000 in Pearl (PRL) cryptocurrency. Experts also observed that nine machines, presumably from a single compute cluster, started mining cryptocurrency simultaneously. After roughly six minutes, the activity stopped, likely due to an administrator’s intervention.
In the technical report Pluto Security links the campaign to a financially motivated Chinese‑language attacker. Supporting this hypothesis are code comments in simplified Chinese, management servers on Alibaba Cloud, and the activity timestamps. The operator’s identity has not been definitively established.
At the time of publishing, Hugging Face had blocked the main malicious model, but a copy on the htt0118 account remained available. Server owners who have downloaded suspicious models with trust_remote_code are advised to check the system for signs of compromise and rotate exposed credentials. Simply removing the miner does not guarantee the backdoor’s removal.
