A crypto-mining campaign abusing Hugging Face models has returned days after a previous takedown, hijacking GPU servers and planting backdoors. One model was downloaded over 28,000 times before removal. Separately, a fake Solana starter kit on GitHub was identified, designed to trick AI coding agents into installing a NetSupport RAT.

What should defenders do?

Organizations and users should verify the authenticity of models and repositories before downloading. Implement code scanning and sandboxing for downloaded AI/ML models and scripts. Update endpoint security controls to detect and block crypto-mining activity and known RATs. Monitor for unusual GPU resource utilization as a potential indicator of compromise.

highMalware

Hugging Face Malware Campaign Resurfaces, Hijacks GPU Servers for Crypto Mining

Threat actors re-deploy malicious models on the Hugging Face Hub, leveraging trust in AI/ML platforms to compromise GPU infrastructure.

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Hugging Face Malware Campaign Resurfaces, Hijacks GPU Servers for Crypto Mining

Key Takeaways

A resurgent crypto-mining campaign is abusing Hugging Face models to hijack GPU servers and plant backdoors.
One malicious model was downloaded over 28,000 times before removal.
A fake Solana starter kit on GitHub targets AI coding agents with a NetSupport RAT delivery mechanism.
Threat actors are exploiting trust in AI/ML collaboration and software development platforms.

Related Security News

highCyber Attacks

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

A newly identified advanced persistent threat group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. Active exploitation has been confirmed, with attackers leveraging the vulnerability to gain unauthenticated remote access and execute arbitrary code on affected controllers. Cisco has released security updates addressing the vulnerability, and administrators are urged to apply the latest firmware updates to mitigate the risk.

BleepingComputerabout 3 hours ago1 min read