Fake AI models on Hugging Face secretly hijack servers to mine crypto

A crypto-mining campaign that hides inside fake AI models on Hugging Face came back within days of being shut down. Its most popular fake model was downloaded 28,412 times by October 28. The models quietly run a hidden crypto miner on servers with powerful graphics chips, and some also give the attacker remote access.

What happened

Researchers at Pluto Security found 31 bad repositories across seven Hugging Face accounts, posted in two waves since September. Hugging Face is a popular site where people share AI models. The fake ones pose as small Qwen2 test models. They target servers that run AI tools such as Xinference and GPUStack.

The trick is not a poisoned model. It is a setting called trust_remote_code, which lets a model bring its own Python code. If a user turns it on, that code runs as soon as the model loads. The top fake, MENXIANGYU/qwen2-tiny, contained no real model at all. Its code installs a miner disguised as a Linux system process, restarts it if it is killed, and removes rival miners.

Why it keeps working

Pluto reported the first wave to Hugging Face and China's ModelScope, and both removed the accounts. A second wave of 19 repositories appeared under new accounts within days. Pluto says those were still live eight days after it reported them. Hugging Face has since disabled the flagship model, but a near-identical copy from an account called htt0118 was still live, and BleepingComputer confirmed it holds the same miner and remote access code.

Hugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog. Pluto says these look for known malware and unsafe file formats, not what a model's Python code actually does. The flagship model scanned clean while it collected downloads. Pluto notes the numbers count downloads, not confirmed infections.

The money and the scale

The attacker's main wallet has received about $5,000 in Pearl (PRL) cryptocurrency, researchers say. Pluto also watched nine machines that appear to belong to a shared research GPU cluster start mining at once. They stopped about six minutes later, which fits an admin killing the jobs. Pluto links the campaign to a financially motivated, Chinese-speaking operator.

What to do

Anyone who loaded these models with trust_remote_code on should treat the machine as compromised. Killing the miner alone does not remove the backdoors.

• Check the machine against the indicators in Pluto's report.
• Change any credentials the machine could reach.
• Do not turn on trust_remote_code for code you do not trust.

A related warning

Separately, Air Security flagged a fake Solana starter kit on GitHub that is built to fool AI coding agents. Its README tells users to paste a PowerShell command that installs a remote access tool. The repository was still live when BleepingComputer wrote its report.