EN PT-BR
← Voltar ao feed
high technology research

Hugging Face cryptomining campaign returns via trust_remote_code; fake Solana kit on GitHub targets AI coding agents

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 19:09 · coletado há 2 dias

Researchers at Pluto Security uncovered 31 malicious repositories across seven Hugging Face accounts, posing as small Qwen2 test checkpoints and abusing the trust_remote_code option to execute attacker Python code on GPU hosts running self-hosted inference servers such as Xinference and GPUStack. The flagship model, MENXIANGYU/qwen2-tiny, contains no model at all and installs a cryptominer disguised as a Linux system process, kills competing miners, persists on restart, and in some versions opens a reverse shell. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repos appeared within days; downloads of the flagship climbed from 7,354 to 28,412 by October 28, and a near-identical copy under account htt0118 remained live. Separately, Air Security reported a GitHub repo, SolanaUpdateTools/solana-starter-kit, that ranks top when AI coding agents search for a Solana starter kit and whose README instructs running a PowerShell one-liner that installs NetSupport Manager as a RAT. Pluto attributes the mining campaign to a financially motivated Chinese-speaking operator with roughly $5,000 in Pearl (PRL) proceeds.

Detalhes técnicos

  • Execution relies on trust_remote_code, which runs model-shipped Python as soon as the model loads — bypassing checks focused on poisoned weights or pickle exploits.
  • One post-report upload included a script capable of container escape to take over the underlying host.
  • Hugging Face scanning with Protect AI and JFrog flagged the file as "not a machine-learning model" but the payload scanned clean while accumulating 28,412 downloads.
  • Attribution signals: Simplified Chinese code comments, C2 servers on Alibaba Cloud, late-night China activity. Nine machines from a shared research GPU cluster were observed mining before being killed ~6 minutes later.
  • The Solana lure: Windows-only PowerShell one-liner assembles a URL on developer-update[.]app, fetches and runs a script in memory, installs NetSupport Manager beaconing to maxwintodaybtc[.]com with persistence at every login, then shows a fake "try again in 72 hours" error. Air linked it to a NetSupport RAT operator tracked by eSentire and to a fake TradingView "AI signal" campaign.

Remediação

  • Treat any host that loaded these models with trust_remote_code enabled as compromised; killing the miner does not remove backdoors.
  • Hunt against Pluto's published indicators and rotate all credentials reachable from affected hosts.
  • Disable trust_remote_code by default on inference servers and vet model repositories before loading.
  • Block developer-update[.]app and maxwintodaybtc[.]com; audit for unauthorized NetSupport Manager installs and avoid letting AI coding agents execute README commands unreviewed.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 29/10/2026 19:09 · coletado 29/10 21:00 primeiro registro

    Hugging Face cryptomining campaign returns via trust_remote_code; fake Solana kit on GitHub targets AI coding agents

    ler a análise desta fonte

    Researchers at Pluto Security uncovered 31 malicious repositories across seven Hugging Face accounts, posing as small Qwen2 test checkpoints and abusing the trust_remote_code option to execute attacker Python code on GPU hosts running self-hosted inference servers such as Xinference and GPUStack. The flagship model, MENXIANGYU/qwen2-tiny, contains no model at all and installs a cryptominer disguised as a Linux system process, kills competing miners, persists on restart, and in some versions opens a reverse shell. After Hugging Face and ModelScope removed the first wave, a second wave of 19 repos appeared within days; downloads of the flagship climbed from 7,354 to 28,412 by October 28, and a near-identical copy under account htt0118 remained live. Separately, Air Security reported a GitHub repo, SolanaUpdateTools/solana-starter-kit, that ranks top when AI coding agents search for a Solana starter kit and whose README instructs running a PowerShell one-liner that installs NetSupport Manager as a RAT. Pluto attributes the mining campaign to a financially motivated Chinese-speaking operator with roughly $5,000 in Pearl (PRL) proceeds.

    Technical Details

    • Execution relies on trust_remote_code, which runs model-shipped Python as soon as the model loads — bypassing checks focused on poisoned weights or pickle exploits.
    • One post-report upload included a script capable of container escape to take over the underlying host.
    • Hugging Face scanning with Protect AI and JFrog flagged the file as "not a machine-learning model" but the payload scanned clean while accumulating 28,412 downloads.
    • Attribution signals: Simplified Chinese code comments, C2 servers on Alibaba Cloud, late-night China activity. Nine machines from a shared research GPU cluster were observed mining before being killed ~6 minutes later.
    • The Solana lure: Windows-only PowerShell one-liner assembles a URL on developer-update[.]app, fetches and runs a script in memory, installs NetSupport Manager beaconing to maxwintodaybtc[.]com with persistence at every login, then shows a fake "try again in 72 hours" error. Air linked it to a NetSupport RAT operator tracked by eSentire and to a fake TradingView "AI signal" campaign.

    Remediation

    • Treat any host that loaded these models with trust_remote_code enabled as compromised; killing the miner does not remove backdoors.
    • Hunt against Pluto's published indicators and rotate all credentials reachable from affected hosts.
    • Disable trust_remote_code by default on inference servers and vet model repositories before loading.
    • Block developer-update[.]app and maxwintodaybtc[.]com; audit for unauthorized NetSupport Manager installs and avoid letting AI coding agents execute README commands unreviewed.