Fake artificial intelligence models posted on Hugging Face turned downloaders' graphics cards into cryptocurrency miners, researchers have found. Pluto Security traced a cryptomining and backdoor campaign across 31 malicious repositories on the platform, spread over seven accounts in two waves since September 2026.

How the trap worked

The fake models posed as small Qwen2 test checkpoints; the most-downloaded, MENXIANGYU/qwen2-tiny, contained no real model at all. The attack abused Hugging Face's trust_remote_code option: when enabled, a model's own Python code runs on the downloader's machine before any model weights load.

With linked models included, the repositories passed 32,000 downloads; the flagship model alone rose from 7,354 downloads on 20 October to 28,412 by 28 October 2026. Pluto stresses that downloads are not confirmed infections. The payload installed a cryptocurrency miner disguised as a Linux system process, restarted it if killed, removed rival miners, and in some versions opened a reverse shell giving the attacker direct server access.

Still live after warnings

Second-wave repositories were still live eight days after Pluto reported them; a near-identical copy uploaded on 25 October by a newer account was still live when BleepingComputer checked, and BleepingComputer confirmed it contained the same miner and reverse shell. The campaign targeted GPU hosts running self-hosted inference servers such as Xinference and GPUStack. The first-wave operator wallet received about 2,276 PRL, roughly $5,000, and was still earning after repositories were removed.

Pluto says the payloads passed Hugging Face's antivirus and partner scanners, which check for known malware and unsafe model formats rather than what a model's Python code does. The lesson for anyone downloading models is blunt: never enable trust_remote_code for an unverified publisher, however plausible the model page looks.

Sources: BleepingComputer and Pluto Security.