Hugging Face · Exploitation confirmed

Malware campaign returns to Hugging Face, hijacks GPUs for mining

Oct 29, 2026 · 2 min read

A campaign dubbed Load/Mine by Pluto Security has returned to Hugging Face after the first wave was taken down: 31 malicious repositories across seven accounts pose as small Qwen2 test models, with 29,818 recorded downloads, not confirmed as infections. Payloads drop a hidden GPU cryptominer disguised as a kernel worker, and some builds add reverse shells, targeting self-hosted AI infrastructure such as Xinference and GPUStack. Review model code, pin reviewed revisions and avoid trust_remote_code=True before enabling custom code.

By HIFY Radar newsroom Updated 10/30/2026 10:17 AM Get this every day →← Back to the feed 2 sources

HighSupply chainExploitation confirmedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A malware campaign has returned to Hugging Face, the AI model platform, posting fake models that hijack GPUs to mine cryptocurrency. Pluto Security traced 31 malicious repositories across seven accounts, posing as small Qwen2 test models, with 29,818 recorded downloads, not confirmed as infections. The first wave was taken down, and a second appeared within days under new accounts.

Why it matters

Teams that downloaded and ran these models may have GPUs tied up in mining, higher cloud costs, and even remote attacker access, as some builds add reverse shells. Targets are self-hosted AI servers (Xinference, GPUStack), rented GPU machines and CI jobs, common in companies training or serving AI. Platform scanners returned clean results on the flagship payload, so the lack of an alert does not mean safe.

What to do

Review the code of models in use and pin reviewed revisions before enabling custom code. Do not load models with trust_remote_code=True without an audit. Check AI servers, GPU machines and CI jobs for suspicious kernel worker processes with abnormal GPU usage.

For the technical team

Affected: Hugging Face, plataforma de modelos de IA; campanha Load/Mine rastreada pela Pluto Security em 31 repositórios maliciosos de sete contas, disfarçados de modelos de teste Qwen2, que sequestram GPUs par · Users who downloaded and ran the 31 malicious Load/Mine repositories across seven accounts. Cited targets: self-hosted AI infrastructure such as Xinference and GPUStack, rented GPU machines and CI jobs.
Exploitation: Active campaign detailed by Pluto Security and covered by BleepingComputer, with 29,818 recorded downloads (Pluto's measurement, not a verified victim count). The second wave appeared within days after the first was taken down. Platform scanners returned clean results on the flagship payload.
Fix: Cited mitigation: review model code and pin reviewed revisions before enabling custom code. The sources cite no vendor fix.
Vector: Hugging Face repositories posing as small Qwen2 test models. Loading a model with trust_remote_code=True runs the attacker's Python before any weights load. No product flaw: it depends on the user running code from the repository.
More details: Campaign dubbed Load/Mine by Pluto Security; operator attribution is the researchers' assessment. The payload drops a hidden GPU cryptominer disguised as a kernel worker, and some builds add reverse shells. The attacker's code runs before any weights load.

Timeline

10/30/2026 10:17 AM
Pluto Security details the Load/Mine campaign: 31 malicious repositories across seven accounts posing as small Qwen2 test models, with 29,818 recorded downloads (not confirmed infections); payloads drop a hidden GPU miner disguised as a kernel worker and some builds add reverse shells.
10/29/2026 07:11 PM
First report: BleepingComputer covers the return of the Hugging Face malware campaign.