---
id: "CMP-202610-malicious-hugging-face-models-posing-as-qwen2-test-checkpoin"
kind: "campaign"
aliases: []
title: "Malicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "Hugging Face Hub", "fixed": [], "ecosystem": "other"}, {"name": "Hugging Face Transformers", "fixed": [], "ecosystem": "pypi"}, {"name": "Xinference", "fixed": [], "ecosystem": "pypi"}, {"name": "GPUStack", "fixed": [], "ecosystem": "other"}, {"name": "ModelScope", "fixed": [], "ecosystem": "other"}]
ecosystems: []
tags: ["campaign", "cryptomining", "early-warning", "hugging-face", "trust_remote_code"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T22:30:02+00:00"
updated_at: "2026-10-29T22:30:02+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T22:30:02+00:00"}]
---

# Malicious Hugging Face models posing as Qwen2 test checkpoints install a crypto miner and reverse shell on GPU inference servers when loaded with trust_remote_code (back after takedown)

Pluto Security found 31 malicious repositories across seven Hugging Face accounts (also on ModelScope), published in two waves since September 2026. They pose as small Qwen2 test checkpoints (e.g. MENXIANGYU/qwen2-tiny, 28,412 downloads by Oct 28) and target GPU hosts running self-hosted inference servers such as Xinference and GPUStack. No poisoned weights or pickle: the model ships Python code that runs on load when trust_remote_code is enabled. It installs a miner disguised as a Linux system process (Pearl/PRL), restarts it if killed, removes competing miners; some versions open a reverse shell, and one later model carries a container-escape script. Hugging Face/JFrog/Protect AI scans passed the payload as clean. First wave was taken down; a second wave of 19 repos appeared within days, and a near-identical copy htt0118/qwen2-tiny (uploaded Oct 25) was still live on Oct 29. Pluto saw real machines (a shared research GPU cluster) mining for the operator. Attributed to a financially motivated Chinese-speaking operator with C2 on Alibaba Cloud. Anyone loading untrusted Hugging Face models with trust_remote_code=True is at risk.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Hugging Face Hub affected ? fixed ?
- pypi:Hugging Face Transformers affected ? fixed ?
- pypi:Xinference affected ? fixed ?
- other:GPUStack affected ? fixed ?
- other:ModelScope affected ? fixed ?

## How to check

Search code, notebooks, Xinference/GPUStack/vLLM/Transformers configs for trust_remote_code=True and for models named MENXIANGYU/qwen2-tiny, htt0118/qwen2-tiny or other unknown 'qwen2-tiny'/Qwen2 test checkpoints; check the Hugging Face cache (~/.cache/huggingface) for these repos. On GPU hosts look for unexpected high GPU use, unknown processes named like system processes, miner connections to mining pools, and outbound reverse-shell connections to Alibaba Cloud IPs. Full indicators are in Pluto Security's report (not reproduced here).

## Fix

Treat any machine that loaded these models with trust_remote_code enabled as compromised: isolate it, check against Pluto's indicators, rebuild it and rotate every credential it could reach (killing the miner does not remove the backdoors). Disable trust_remote_code by default on inference servers; only allow it for models from pinned, reviewed repositories and revisions. Do not rely on Hugging Face's malware scan to catch malicious model code.

## Timeline

- 2026-10-29T22:30:02+00:00 analyst

## Documents

- [describes] BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
- [describes] @BleepinComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining - @Ax_Sha https://x.com/BleepinComputer/status/2115929085822087523

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_