{"id":"CMP-202610-malicious-hugging-face-models-posing-as-qwen2-test-checkpoin","kind":"campaign","aliases":[],"related":[],"title":"Malicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)","description":null,"summary":"Pluto Security found 31 malicious repositories across seven Hugging Face accounts (also on ModelScope), published in two waves since September 2026. They pose as small Qwen2 test checkpoints (e.g. MENXIANGYU/qwen2-tiny, 28,412 downloads by Oct 28) and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. No poisoned weights or pickle: the model ships Python code that runs on load when trust_remote_code is enabled. It installs a miner disguised as a Linux system process (Pearl/PRL), restarts it if killed, removes competing miners; some versions open a reverse shell, and one later model carries a container-escape script. Hugging Face/JFrog/Protect AI scans passed the payload as clean. First wave was taken down; a second wave of 19 repos appeared within days, and a near-identical copy htt0118/qwen2-tiny (uploaded Oct 25) was still live on Oct 29. Pluto saw real machines (a shared research GPU cluster) mining for the operator. Attributed to a financially motivated Chinese-speaking operator with C2 on Alibaba Cloud. Anyone loading untrusted Hugging Face models with trust_remote_code=True is at risk.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-29T22:30:02+00:00","products":[{"name":"Hugging Face Hub","fixed":[],"ecosystem":"other"},{"name":"Hugging Face Transformers","fixed":[],"ecosystem":"pypi"},{"name":"Xinference","fixed":[],"ecosystem":"pypi"},{"name":"GPUStack","fixed":[],"ecosystem":"other"},{"name":"ModelScope","fixed":[],"ecosystem":"other"}],"ecosystems":[],"tags":["campaign","cryptomining","early-warning","hugging-face","trust_remote_code"],"not_affected_if":[],"how_to_check":"Search code, notebooks, Xinference/GPUStack/vLLM/Transformers configs for trust_remote_code=True and for models named MENXIANGYU/qwen2-tiny, htt0118/qwen2-tiny or other unknown 'qwen2-tiny'/Qwen2 test checkpoints; check the Hugging Face cache (~/.cache/huggingface) for these repos. On GPU hosts look for unexpected high GPU use, unknown processes named like system processes, miner connections to mining pools, and outbound reverse-shell connections to Alibaba Cloud IPs. Full indicators are in Pluto Security's report (not reproduced here).","fix":"Treat any machine that loaded these models with trust_remote_code enabled as compromised: isolate it, check against Pluto's indicators, rebuild it and rotate every credential it could reach (killing the miner does not remove the backdoors). Disable trust_remote_code by default on inference servers; only allow it for models from pinned, reviewed repositories and revisions. Do not rely on Hugging Face's malware scan to catch malicious model code.","status":"open","published_at":null,"first_seen_at":"2026-10-29T22:30:02+00:00","triaged_at":"2026-10-29T22:30:02+00:00","updated_at":"2026-10-29T22:30:02+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':31A '19':185B '2026':82B '25':199B '28':92B,97B '29':205B '31':65B '412':93B 'account':72B 'across':68B 'ai':169B 'alibaba':231B 'also':73B 'anyon':233B 'appear':187B 'as':38A 'attribut':219B 'back':27A 'c2':229B 'campaign':51B 'carri':161B 'checkpoin':41A 'checkpoint':9A,89B 'chines':225B 'chinese-speak':224B 'clean':175B 'cloud':232B 'cluster':214B 'cmp':30A 'code':26A,61B,122B,130B,242B 'compet':149B 'contain':164B 'container-escap':163B 'copi':195B 'crypto':12A 'cryptomin':52B 'day':189B 'disguis':137B 'download':94B 'e.g':90B 'earli':54B 'early-warn':53B 'enabl':132B 'escap':165B 'face':3A,35A,43A,46A,58B,71B,237B 'face/jfrog/protect':168B 'financi':222B 'first':176B 'found':64B 'gpu':18A,100B,213B 'gpustack':49A,112B 'host':101B,105B 'htt0118/qwen2-tiny':196B 'hub':44A 'hug':2A,57B,70B,167B,236B 'hugging':34A,42A,45A 'hugging-fac':56B 'ident':194B 'infer':19A,106B 'instal':10A,134B 'kill':147B 'later':159B 'linux':140B 'live':202B 'load':22A,126B,234B 'machin':209B 'malici':1A,66B 'malicious':33A 'malicious-hugging-face-models-posing-as-qwen2-test-checkpoin':32A 'menxiangyu/qwen2-tiny':91B 'mine':215B 'miner':13A,136B,150B 'model':4A,119B,160B,238B 'models':36A 'modelscop':75B 'modelscope':50A 'motiv':223B 'near':193B 'near-ident':192B 'oct':96B,198B,204B 'one':158B 'open':153B 'oper':218B,227B 'pass':171B 'payload':173B 'pearl/prl':143B 'pickl':117B 'pluto':62B,206B 'poison':114B 'pose':5A,84B 'posing':37A 'process':142B 'publish':76B 'python':121B 'qwen2':7A,39A,87B 'real':208B 'remot':25A,60B,129B,241B 'remov':148B 'repo':186B 'repositori':67B 'research':212B 'restart':144B 'revers':15A,155B 'risk':246B 'run':102B,124B 'saw':207B 'scan':170B 'script':166B 'second':182B 'secur':63B 'self':104B 'self-host':103B 'septemb':81B 'server':20A,107B 'seven':69B 'share':211B 'shell':16A,156B 'ship':120B 'sinc':80B 'small':86B 'speak':226B 'still':201B 'system':141B 'takedown':29A 'taken':179B 'target':99B 'test':8A,40A,88B 'transformers':47A 'true':243B 'trust':24A,59B,128B,240B 'two':78B 'untrust':235B 'upload':197B 'version':152B 'warn':55B 'wave':79B,177B,183B 'weight':115B 'within':188B 'xinfer':110B 'xinference':48A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T22:09:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-malicious-hugging-face-models-posing-as-qwen2-test-checkpoin","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T22:30:02+00:00","fetched_at":"2026-10-29T22:30:02+00:00","note":null}],"documents":[{"id":19691,"url":"https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/","title":"BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining","kind":"blog","source":"blog","publisher":null,"text":"Hugging Face malware campaign returns to hijack GPUs for crypto mining\n\nA crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]","published_at":"2026-10-29T22:09:24+00:00","relation":"describes","confidence":null,"note":null},{"id":19646,"url":"https://x.com/BleepinComputer/status/2115929085822087523","title":"@BleepinComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining - @Ax_Sha","kind":"post","source":"x","publisher":null,"text":"Hugging Face malware campaign returns to hijack GPUs for crypto mining - @Ax_Sharma\nhttps://t.co/HYVqXBYwWo\n\nlikes 15 reposts 6","published_at":"2026-10-29T22:09:40+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}