Introduction

Pluto Security has uncovered a self-iterating cryptominer campaign that embedded malicious code within Hugging Face AI models, leveraging the trust_remote_code flag to execute payloads automatically when users loaded affected models. The operation turned legitimate AI downloads into covert mining operations, affecting thousands of repositories.

What Happened

The campaign unfolded in two waves across Hugging Face and a ModelScope mirror, spanning 28 repositories and 35 total variants. The second wave, still active as of late October, centered on the MENXIANGYU/qwen2-tiny model, which alone drove the vast majority of downloads. Attackers embedded auto-map configurations in repository config files, triggering Python loaders that ran with caller privileges during model initialization. This fileless approach avoided the need for malicious model weights, relying instead on injected code executed during the Transformers library's model-loading pipeline.

Why This Matters

Beyond the immediate download counts, the campaign reveals how easily AI model hubs can be abused for persistent, fileless malware distribution. The operators evolved their code between waves, replacing hardcoded SSH keys with reverse shells and adjusting C2 infrastructure to evade detection. Financial traces show the first-wave wallet collected over $5,000 in cryptocurrency before repositories were taken down, and persistence mechanisms such as SSH key placement, bashrc hooks, and cron jobs ensured access survived model removal. The operation's linguistic fingerprints, Alibaba Cloud C2 server, and targeted focus on Xinference and Tencent Cloud ecosystems point to a financially motivated, Chinese-speaking threat actor.

Key Takeaways

  • Always verify the content of Python files referenced by auto_map before enabling trust_remote_code, and pin specific revisions to prevent unintended updates.
  • Run untrusted code with limited privileges, restricted network access, and no exposure of production secrets or cloud credentials.
  • Monitor for process names like [kworker/u20:1], files in /tmp/.cch/, and unexpected persistence hooks in user startup scripts.
  • Rotate tokens, SSH keys, and passwords from a clean machine if a model from the affected list was previously loaded.
  • Implement static upload-time checks for subprocess, socket, ctypes, or raw-IP network calls in files auto-mapped by Hugging Face Transformers.

Conclusion

The discovery of a self-iterating cryptominer embedded in open-source AI models serves as a critical wake-up call for the machine learning community. As model hubs become central to development workflows, proactive security practices, least-privilege execution, and continuous monitoring are essential to prevent malicious code from turning trusted repositories into attack vectors. Vigilance and rapid response remain the best defenses against this evolving threat landscape.