Fake Qwen2 Hugging Face models return to hijack GPU servers for crypto mining
Anyone who loaded the affected models with trust_remote_code enabled should treat those machines as compromised and rotate any reachable credentials.
Pluto Security has traced a cryptomining and backdoor campaign that abuses Hugging Face model repositories, which returned within days after the first wave was removed. The 31 malicious repositories, spread across seven accounts and published in two waves since September, impersonate small Qwen2 test checkpoints aimed at GPU servers running Xinference or GPUStack. Their code executes when users enable trust_remote_code, so a flagship model with no real weights installs a disguised miner and sometimes a reverse shell, and it passed Hugging Face's malware scans while accumulating 28,412 downloads by October 28. Pluto estimates the operator's wallet has received about $5,000 in Pearl cryptocurrency. Separately, Air Security flagged a Windows-only fake Solana starter kit on GitHub that AI coding agents may pick and run, which installs the NetSupport remote-access tool; anyone who loaded the affected models should treat those machines as compromised and rotate reachable credentials.
Why it matters
The campaign shows that model repositories can carry executable code that runs on the machines that load them, and that a flagship-looking model with no real weights can be downloaded tens of thousands of times before it is caught. Operators of GPU servers running self-hosted inference tools are the people most exposed, because the malicious code runs on their own hardware and can open a reverse shell back to the attacker. The separate fake Solana starter kit points to a related risk: AI coding agents may pick and run such code without a person reviewing it first.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.