# Fake Qwen2 models on Hugging Face mine crypto and open reverse shells on GPU hosts, back within days of takedown · pwn.watch > Pluto Security found 31 malicious Hugging Face repositories across seven accounts, posing as small Qwen2 test checkpoints, that run attacker Python as soon as they are loaded with trust_remote_code=True. The code installs a fileless peakminer cryptominer disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks and, in some builds, reverse shells, targeting self-hosted inference servers such as Xinference and GPUStack. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repositories appeared within days; the flagship MENXIANGYU/qwen2-tiny reached 28,412 downloads and scanned clean. Anyone who loaded these models with custom code enabled should treat the host as compromised, check Pluto's indicators, remove persistence and rotate every credential the process could reach. Page: https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026 · generated 2026-10-30T00:34:54.267Z ## Status - Severity: high · status: live · patch: partial - Product: Malicious Hugging Face model repositories (MENXIANGYU, wjsbg, htt0118, soumikmahato, r1r13 and others) loaded with trust_remote_code - Started: 2026-09-21 - Affected: MENXIANGYU/qwen2-tiny, qwen2-tiny-2, -3, -4, -5, -6, -9, qwen2-mini-c4, qwen2-mini-c5, qwen2-ezv, llama-tiny-x1019, zz_ext, qa-whl-1021; wjsbg/eagle-tiny, qwen2-tiny-zh21, qwen2-final, zh-assets; htt0118/qwen2-tiny; soumikmahato/qwen2-tiny-chat; r1r13/qwen-lora-text-v1; First wave (removed): hhzz667/*, dsxk4mr8tq/*, wssb123e on ModelScope - Fixed in: No fix: don't load these repositories; review auto_map .py files before setting trust_remote_code and rebuild hosts that loaded them ## Follow this incident - RSS (one item per update): https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026.json - This file: https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026/llms.txt ## Updates (newest first) - 2026-10-29: Pluto publishes the report with indicators: the flagship MENXIANGYU/qwen2-tiny hit 28,412 downloads by Oct 28 and scanned clean. BleepingComputer reports Hugging Face has disabled that model but the htt0118 copy is still live. (https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/) - 2026-10-25: New account htt0118 uploads a near-identical qwen2-tiny copy with the same pool login and reverse-shell receivers. (https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) - 2026-10-20: A second wave of 19 repositories under new accounts is live; 8.5 hours after Pluto's disclosure the operator publishes MENXIANGYU/qa-whl-1021, a container-to-host escape script aimed at GPUStack hosts. (https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) - 2026-10-12: Pluto's scanner flags throwaway account dsxk4mr8tq; leftover backup files link it to hhzz667 and the wssb123e ModelScope mirror. Pluto reports the first wave and Hugging Face and ModelScope remove the accounts. (https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) - 2026-09-21: Pluto: account hhzz667 publishes qwen2-shell, a 37-line SSH backdoor, then fuller miner builds over the next day. (https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) ## Fix brief # Security brief: Fake Qwen2 models on Hugging Face mine crypto and open reverse shells on GPU hosts, back within days of takedown Source: https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 22:25 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Pluto Security found 31 malicious Hugging Face repositories across seven accounts, posing as small Qwen2 test checkpoints, that run attacker Python as soon as they are loaded with trust_remote_code=True. The code installs a fileless peakminer cryptominer disguised as [kworker/u20:1], a watchdog in /tmp/.cch, shell-startup hooks and, in some builds, reverse shells, targeting self-hosted inference servers such as Xinference and GPUStack. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repositories appeared within days; the flagship MENXIANGYU/qwen2-tiny reached 28,412 downloads and scanned clean. Anyone who loaded these models with custom code enabled should treat the host as compromised, check Pluto's indicators, remove persistence and rotate every credential the process could reach. Severity detail: Remote code execution on GPU and inference hosts that load the models with trust_remote_code; 32,000+ downloads (not confirmed infections), backdoors outlast the miner - Product: Malicious Hugging Face model repositories (MENXIANGYU, wjsbg, htt0118, soumikmahato, r1r13 and others) loaded with trust_remote_code ## Affected versions - MENXIANGYU/qwen2-tiny, qwen2-tiny-2, -3, -4, -5, -6, -9, qwen2-mini-c4, qwen2-mini-c5, qwen2-ezv, llama-tiny-x1019, zz_ext, qa-whl-1021 - wjsbg/eagle-tiny, qwen2-tiny-zh21, qwen2-final, zh-assets - htt0118/qwen2-tiny - soumikmahato/qwen2-tiny-chat - r1r13/qwen-lora-text-v1 - First wave (removed): hhzz667/*, dsxk4mr8tq/*, wssb123e on ModelScope ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No fix: don't load these repositories; review auto_map .py files before setting trust_remote_code and rebuild hosts that loaded them After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 29, 2026: Pluto publishes the report with indicators: the flagship MENXIANGYU/qwen2-tiny hit 28,412 downloads by Oct 28 and scanned clean. BleepingComputer reports Hugging Face has disabled that model but the htt0118 copy is still live. - Oct 25, 2026: New account htt0118 uploads a near-identical qwen2-tiny copy with the same pool login and reverse-shell receivers. - Oct 20, 2026: A second wave of 19 repositories under new accounts is live; 8.5 hours after Pluto's disclosure the operator publishes MENXIANGYU/qa-whl-1021, a container-to-host escape script aimed at GPUStack hosts. - Oct 12, 2026: Pluto's scanner flags throwaway account dsxk4mr8tq; leftover backup files link it to hhzz667 and the wssb123e ModelScope mirror. Pluto reports the first wave and Hugging Face and ModelScope remove the accounts. - Sep 21, 2026: Pluto: account hhzz667 publishes qwen2-shell, a 37-line SSH backdoor, then fuller miner builds over the next day. ## Write-ups & news - [Load/Mine: A Hugging Face Malware Campaign Returns After Takedown](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) - [Hugging Face malware campaign returns to hijack GPUs for crypto mining](https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/) ## Caveats Download counts are not confirmed infections. Pluto saw the first-wave wallet earn about 2,276 PRL (~$5,000) and watched nine shared-cluster GPU workers start mining at once before stopping about six minutes later. Quick host checks: /tmp/.cch/, svc.py lines in ~/.bashrc or /root/.profile, a [kworker/u20:1] process with mining arguments, qwen2-tiny- names in the Xinference registry, connections to 212.32.253.3, and the qx-5090-op key in authorized_keys. --- Machine-readable: https://pwn.watch/i/hugging-face-qwen2-tiny-cryptominer-models-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.