CERT24Hugging Face malware campaign returns to hijack GPUs for crypto miningLoading data…
CERT24Threat Observatory
Period

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of being taken down. Thirty-one malicious repositories targeted GPU hosts running self-hosted inference servers, and the most popular model was downloaded more than 28,000 times. A separate GitHub repository presented as a Solana starter kit instead installed NetSupport Manager configured for remote access.

← Back to intelligence

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A cryptomining and backdoor campaign abusing Hugging Face model repositories returned within days of being taken down. Thirty-one malicious repositories targeted GPU hosts running self-hosted inference servers, and the most popular model was downloaded more than 28,000 times. A separate GitHub repository presented as a Solana starter kit instead installed NetSupport Manager configured for remote access.