Sep 21, 2026
1 new incident, 0 with updates.
Started
- LiveHighPartly patched
Fake Qwen2 models on Hugging Face mine crypto and open reverse shells on GPU hosts, back within days of takedown
Pluto Security found 31 malicious Hugging Face repositories across seven accounts, posing as small Qwen2 test checkpoints, that run attacker Python as soon as they are loaded with trust_remote_code=True. The code installs a fileless peakminer cryptominer disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks and, in some builds, reverse shells, targeting self-hosted inference servers such as Xinference and GPUStack. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repositories appeared within days; the flagship MENXIANGYU/qwen2-tiny reached 28,412 downloads and scanned clean. Anyone who loaded these models with custom code enabled should treat the host as compromised, check Pluto's indicators, remove persistence and rotate every credential the process could reach.
Malicious Hugging Face model repositories (MENXIANGYU, wjsbg, htt0118, soumikmahato, r1r13 and others) loaded with trust_remote_codeSince Sep 21, 2026
