Fake Qwen2 models on Hugging Face mine crypto and open reverse shells on GPU hosts, back within days of takedown
Malicious Hugging Face model repositories (MENXIANGYU, wjsbg, htt0118, soumikmahato, r1r13 and others) loaded with trust_remote_code
Pluto Security found 31 malicious Hugging Face repositories across seven accounts, posing as small Qwen2 test checkpoints, that run attacker Python as soon as they are loaded with trust_remote_code=True. The code installs a fileless peakminer cryptominer disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks and, in some builds, reverse shells, targeting self-hosted inference servers such as Xinference and GPUStack. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repositories appeared within days; the flagship MENXIANGYU/qwen2-tiny reached 28,412 downloads and scanned clean. Anyone who loaded these models with custom code enabled should treat the host as compromised, check Pluto's indicators, remove persistence and rotate every credential the process could reach.
Why this severity: Remote code execution on GPU and inference hosts that load the models with trust_remote_code; 32,000+ downloads (not confirmed infections), backdoors outlast the miner
- Started
- Sep 21, 2026
Affected
- MENXIANGYU/qwen2-tiny, qwen2-tiny-2, -3, -4, -5, -6, -9, qwen2-mini-c4, qwen2-mini-c5, qwen2-ezv, llama-tiny-x1019, zz_ext, qa-whl-1021
- wjsbg/eagle-tiny, qwen2-tiny-zh21, qwen2-final, zh-assets
- htt0118/qwen2-tiny
- soumikmahato/qwen2-tiny-chat
- r1r13/qwen-lora-text-v1
- First wave (removed): hhzz667/*, dsxk4mr8tq/*, wssb123e on ModelScope
Fixed in
- No fix: don't load these repositories; review auto_map .py files before setting trust_remote_code and rebuild hosts that loaded them
Timeline5
Pluto publishes the report with indicators: the flagship MENXIANGYU/qwen2-tiny hit 28,412 downloads by Oct 28 and scanned clean. BleepingComputer reports Hugging Face has disabled that model but the htt0118 copy is still live.
New account htt0118 uploads a near-identical qwen2-tiny copy with the same pool login and reverse-shell receivers.
A second wave of 19 repositories under new accounts is live; 8.5 hours after Pluto's disclosure the operator publishes MENXIANGYU/qa-whl-1021, a container-to-host escape script aimed at GPUStack hosts.
Pluto's scanner flags throwaway account dsxk4mr8tq; leftover backup files link it to hhzz667 and the wssb123e ModelScope mirror. Pluto reports the first wave and Hugging Face and ModelScope remove the accounts.
Pluto: account hhzz667 publishes qwen2-shell, a 37-line SSH backdoor, then fuller miner builds over the next day.
News & write-ups2
Notes & caveats
Download counts are not confirmed infections. Pluto saw the first-wave wallet earn about 2,276 PRL (~$5,000) and watched nine shared-cluster GPU workers start mining at once before stopping about six minutes later. Quick host checks: /tmp/.cch/, svc.py lines in ~/.bashrc or /root/.profile, a [kworker/u20:1] process with mining arguments, qwen2-tiny-<base32> names in the Xinference registry, connections to 212.32.253.3, and the qx-5090-op key in authorized_keys.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
