"The second-wave flagship scanned clean while it collected 28,412 downloads," Pluto Security said — a terse sentence that captures how a small change in a model-hosting workflow let attackers turn trusted repositories into a fast, effective crypto-mining and backdoor distribution channel.
Pluto Security's discovery and the campaign timeline
Researchers at Pluto Security found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September. Pluto reported the first wave to Hugging Face and China's ModelScope; both removed the offending accounts. Within days a second wave of 19 repositories reappeared under new accounts, and hours after the initial report the operator published another model that included a script capable of breaking out of a container and taking over the host server.
Pluto tracked downloads across the linked repositories at more than 32,000; that metric counts repository downloads, not confirmed infections. The campaign's single most-downloaded model, MENXIANGYU/qwen2-tiny, rose from 7,354 downloads when Pluto reported it to 28,412 by October 28. As of the story's publication Hugging Face disabled access to that model, though a near-identical copy uploaded on October 25 by a newer account, htt0118, remained live; BleepingComputer confirmed that copy contained the same miner and reverse shell.
How the models hijacked GPUs and servers
Rather than using poisoned weights or pickle exploits, the operator abused a Hugging Face option called trust_remote_code that allows a model to ship its own Python code. When a user enables trust_remote_code, that code runs on the host as soon as the model loads. The repositories posed as small Qwen2 test checkpoints and targeted GPU hosts running self-hosted inference servers such as Xinference and GPUStack.
The MENXIANGYU/qwen2-tiny repository contained no model at all. Its code quietly installed a cryptocurrency miner disguised as a Linux system process, restarted the miner if it was killed, and removed competing miners from the machine. Some versions also opened a reverse shell, giving the attacker direct access to the infected server. In one instance Pluto observed nine machines that appeared to belong to a shared research GPU cluster begin mining for the operator at once; they stopped about six minutes later, consistent with an administrator killing the jobs.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDetection, takedowns, and persistence
Hugging Face scans uploads with antivirus and partner tools, including Protect AI and JFrog. Pluto noted those scans look for known malware and unsafe model formats rather than analyzing what a model's Python code does. JFrog reported the payload file was "not a machine-learning model," yet Pluto observed the "second-wave flagship scanned clean while it collected 28,412 downloads."
Pluto says the operator's main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency, and it remained active on mining pools even after some repositories were removed. Because the operator was able to reupload under new accounts and publish breakout-capable scripts hours after reporting, Pluto found multiple repositories still live eight days after it first notified platforms.
Air Security and the fake Solana starter kit that targets AI coding agents
In a separate report Air Security flagged a GitHub repository, SolanaUpdateTools/solana-starter-kit, created in November 2025 and sitting near the top of search results for a "Solana starter kit." The repository had 286 stars but contained only a README. The README's single installation step instructs users to paste a PowerShell one-liner into a command prompt; that Windows-only command assembles a URL on developer-update[.]app from fragments and fetches and runs a script directly in memory.
BleepingComputer obtained the archived payload via the Wayback Machine and confirmed Air's findings. The payload installed NetSupport Manager configured to connect to maxwintodaybtc[.]com, giving the attacker hidden, persistent access at every login. The script then displayed a fake error message — "developer functionality is temporarily paused due to load" — which an AI agent could easily relay as a routine service hiccup. Air linked the setup to a NetSupport RAT operator tracked by eSentire and to an earlier campaign that targeted crypto traders with fake TradingView "AI signal" tools. At the time Air checked the payload URL returned a 404; the GitHub repository remained live.
What this means for technologists, GitHub users, and research cluster operators
- Technologists and security teams: Anyone who loaded these Hugging Face models with trust_remote_code enabled should treat the machine as compromised, check it against the indicators in Pluto's report, and rotate any credentials the host could reach. Pluto stresses that killing the miner alone does not remove backdoors.
- GitHub users and AI coding-agent operators: An agent that follows top search results and executes README instructions can run attacker-supplied commands without human review; the Solana starter kit demonstrates how a single-line PowerShell command can deliver a remote-access trojan.
- Shared research cluster operators: Simultaneous mining across multiple nodes — Pluto observed nine machines begin mining and then stop when an admin intervened — is an actionable signal. Mining pool activity and unexpected persistent processes disguised as system daemons are specific indicators to monitor.
These events underscore a recurring point from the Blue Report 2026: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The technical detail is plain — model-serving workflows that allow remote code execution widen the attack surface, and simple lookups or README-driven automation can flip a developer convenience into a live intrusion.
