Malicious Hugging Face models hijack GPU servers for crypto mining and open backdoors

A cryptomining and backdoor campaign that abuses Hugging Face model repositories has returned within days of being taken down, according to BleepingComputer, which cited research by Pluto Security. The operation hides malicious code inside what look like harmless AI model test files, and its most-downloaded malicious model had been pulled more than 28,000 times before Hugging Face disabled it. The case highlights how machine-learning supply chains can be weaponized against the GPU servers that run self-hosted AI.

How the campaign works

Pluto Security told BleepingComputer it found 31 malicious repositories spread across seven Hugging Face accounts, published in two waves since September; counting linked models, the repositories accumulated more than 32,000 downloads. Pluto notes that figure reflects downloads, not confirmed infections. Rather than relying on poisoned weights or pickle exploits, the models abuse the trust_remote_code option, which lets a model ship Python code that executes when the model is loaded and the user has enabled that setting.

According to the report, the flagship model — MENXIANGYU/qwen2-tiny — contained no actual model at all. Its code installed a cryptominer disguised as a Linux system process, restarted it if killed, and removed competing miners. Some versions opened a reverse shell that gave the attacker direct access to the infected server, and Pluto said a later model included a script that could break out of a container and take over the underlying host.

Who is affected

The campaign targets GPU hosts running self-hosted inference servers such as Xinference and GPUStack. In one episode described by Pluto, nine machines that appeared to belong to a shared research GPU cluster began mining for the operator simultaneously and stopped about six minutes later — a pattern Pluto said fits an administrator killing the jobs. The flagship model climbed from 7,354 downloads when Pluto first reported it to 28,412 by October 28. BleepingComputer confirmed that a near-identical copy uploaded on October 25 by a newer account (htt0118) was still live and carried the same miner and reverse shell.

Pluto attributes the campaign to a financially motivated, Chinese-speaking operator, citing Simplified Chinese code comments, command-and-control servers on Alibaba Cloud and late-night activity aligned with Chinese time zones. The operator's main wallet reportedly received around $5,000 in Pearl (PRL) cryptocurrency.

Detection gaps and what to do

Pluto said Hugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog, but that these look for known malware and unsafe formats rather than what a model's code actually does. The researchers told BleepingComputer: "The second-wave flagship scanned clean while it collected 28,412 downloads." After Pluto's first report, Hugging Face and China's ModelScope removed the initial accounts, but a second wave of 19 repositories appeared under new accounts within days and remained live eight days later; Hugging Face has since disabled the flagship model.

Pluto advises anyone who loaded these models with trust_remote_code enabled to treat the machine as compromised, compare it against the indicators in Pluto's report, and rotate any reachable credentials — stressing that simply killing the miner does not remove the backdoors. More broadly, operators of self-hosted inference servers should disable trust_remote_code unless strictly necessary, load only vetted models, and monitor GPU hosts for unexpected processes and outbound connections.