Kriptomayning va orqa eshik kampaniyasi, Hugging Face model omborlaridan foydalanib, olib tashlanganidan bir necha kun o'tib qaytdi.
Uning eng mashhur zararli modeli 28 000 martadan ortiq yuklab olingan.
Alohida, tadqiqotchilar GitHub'da 2025-yil oxiridan beri faol bo'lgan soxta Solana boshlang'ich to'plamini aniqladilar, u AI kodlash agentlarini masofaviy kirish troyanini o'rnatishga aldash uchun mo'ljallangan.
Kod model yuklanishidan oldin ishlaydi
Pluto Security tadqiqotchilari sentyabrdan beri yetti Hugging Face hisobida nashr etilgan 31 ta zararli omborni topdilar, ular ikki to'lqinda nashr etilgan.
Modellar kichik Qwen2 sinov nazorat nuqtalari sifatida niqoblanadi. Ular o'z-o'zini xost qiladigan Xinference va GPUStack kabi inferens serverlarini ishlatadigan GPU xostlarini nishonga oladi.
Bog'langan modellar bilan birga, omborlar 32 000 dan ortiq yuklab olishga ega. Pluto bu yuklab olishlar sonini, tasdiqlangan infeksiyalar emas, deb ta'kidlaydi.
Zaharlangan og'irliklar yoki pickle ekspluatatsiyalaridan foydalanish o'rniga, kampaniya Hugging Face'ning trustremotecode opsiyasidan foydalanadi, bu modelga o'z Python kodini jo'natish imkonini beradi. Foydalanuvchi uni yoqsa, bu kod model yuklanishi bilan darhol ularning mashinasida ishlaydi.
Eng ko'p yuklab olingan model, MENXIANGYU/qwen2-tiny, aslida hech qanday modelni o'z ichiga olmagan. Uning kodi Linux tizim jarayoni sifatida niqoblangan kriptovalyuta qazib oluvchini jimgina o'rnatadi, o'ldirilsa qayta ishga tushiradi va mashinadan raqobatchi qazib oluvchilarni olib tashlaydi.
Ba'zi versiyalar shuningdek, teskari qobiq (reverse shell) ochadi, bu hujumchiga infeksiyalangan serverga to'g'ridan-to'g'ri kirish imkonini beradi.
Olib tashlanganidan bir necha kun ichida qaytish
Pluto kampaniyani sinov hisobining qoldiq zaxira fayllari hujumchining asosiy hisoblariga ishora qilgani orqali topdi. U birinchi to'lqinni Hugging Face va Xitoyning ModelScope'iga xabar qildi va har ikkisi ham hisoblarni olib tashladi.
Pluto sinov hisobini kampaniyaning asosiy hisoblari bilan qanday bog'lagan (Pluto Security)
Yangi hisoblar ostida 19 ta omborning ikkinchi to'lqini bir necha kun ichida paydo bo'ldi.
Pluto xabar qilganidan bir necha soat o'tib, operator konteynerdan qochib, ostidagi serverni egallashi mumkin bo'lgan skript bilan yana bir model nashr etdi.
Pluto ikkinchi to'lqin omborlari xabar qilinganidan sakkiz kun o'tib ham faol ekanligini aytadi. Asosiy modelning yuklab olishlari xabar berilgan vaqtdagi 7 354 dan 28-oktabrgacha 28 412 ga ko'tarildi.
Yozish paytida, Hugging Face ushbu modelga kirishni o'chirib qo'ygan. 25-oktabrda yangi hisob, htt0118, tomonidan yuklangan deyarli bir xil nusxa hali ham faol va BleepingComputer u xuddi shu qazib oluvchi va teskari qobiqni o'z ichiga olganini tasdiqladi:
'htt0118/qwen2-tiny' modeli yozish paytida Hugging Face'da hali ham faol (BleepingComputer)
Toza skanlar, haqiqiy to'lovlar
Hugging Face yuklamalarni antivirus va Protect AI hamda JFrog hamkor vositalari bilan skanlaydi. Pluto bu vositalar ma'lum zararli dasturlar va xavfsiz bo'lmagan model formatlarini qidiradi, modelning Python kodi aslida nima qilayotganini emas, deb aytadi.
"Ikkinchi to'lqin asosiy modeli 28 412 yuklab olish bilan toza skanlandi," deb tadqiqotchilar aytdilar va JFrog yuklangan fayl "mashina o'rganish modeli emas" deb xabar qilganini qo'shdilar.
Pluto ma'lumotiga ko'ra, operatorning asosiy hamyoni Pearl (PRL) kriptovalyutasida taxminan 5 000 dollar olgan. Uning ortidagi omborlar olib tashlanganidan keyin ham u qazib olish hovuzlarida faol edi.
Tadqiqotchilar kuzatayotgan paytda, umumiy tadqiqot GPU klasteriga tegishli ko'rinadigan to'qqizta mashina bir vaqtda operator uchun qazib olishni boshladi.
Ular taxminan olti daqiqa keyin to'xtadi, Pluto buni administrator ishlarni o'ldirgani bilan mos keladi, deb aytadi.
Pluto kampaniyani moliyaviy motivatsiyaga ega, xitoy tilida so'zlashuvchi operator bilan bog'laydi. U soddalashtirilgan xitoycha kod izohlarini, Alibaba Cloud'dagi buyruq va nazorat serverlarini va Xitoyda kechki soatlarda faoliyatni dalil sifatida keltiradi.
Ushbu modellarni trustremotecode yoqilgan holda yuklagan har kim mashinani buzilgan deb hisoblashlari, Pluto hisobotidagi ko'rsatkichlarga nisbatan tekshirishlari va u erishishi mumkin bo'lgan har qanday ma'lumotlarni aylantirishlari kerak. Faqat qazib oluvchini o'ldirish orqa eshiklarni olib tashlamaydi.
Soxta Solana to'plami AI kodlash agentlarini nishonga oladi
Alohida hisobotda, Air Security GitHub ombori, SolanaUpdateTools/solana-starter-kit, haqida xabar beradi va u AI kodlash agentlari Solana boshlang'ich to'plamini qidirganda eng yuqori natija sifatida ko'rinishini aytadi.
Omborni tanlab, uning README'siga amal qiladigan agent ishlab chiquvchi hech qachon ko'rmasdan hujumchining buyrug'ini bajarishi mumkin.
Ombor 2025-yil noyabrda yaratilgan va 286 yulduzga ega. Uning README'si to'liq Solana ilova shablonini va'da qiladi, lekin bu kodning hech biri mavjud emas va README ombordagi yagona fayl:
Soxta Solana boshlang'ich to'plami yozish paytida GitHub'da hali ham faol (BleepingComputer)
README'dagi yagona "o'rnatish" qadami foydalanuvchilarga PowerShell bir qatorini buyruq satriga joylashtirishni aytadi. Faqat Windows uchun mo'ljallangan buyruq developer-update[.]app da URL'ni bo'laklardan yig'adi, so'ngra undan skriptni xotirada oladi va ishga tushiradi.
BleepingComputer Internet Archive'ning Wayback Machine'dan arxivlangan yukni oldi va Air topilmalarini tasdiqladi.
Yuk NetSupport Manager'ni, qonuniy masofaviy kirish vositasini, maxwintodaybtc[.]com ga ulanish va hujumchiga har kirishda mashinani yashirin nazorat qilish imkonini berish uchun sozlangan holda o'rnatadi.
So'ngra skript "ishlab chiquvchi funksionalligi yuk tufayli vaqtincha to'xtatilgan" va "72 soatdan keyin qayta urinib ko'ring" deb yozilgan soxta xato xabarini ko'rsatadi, bu agent tomonidan odatiy server muammosi sifatida osongina uzatilishi mumkin.
Air bu sozlamani eSentire tomonidan kuzatiladigan ma'lum NetSupport RAT operatori bilan va kripto savdogarlarini soxta TradingView "AI signal" vositalari bilan jalb qilgan oldingi kampaniya bilan bog'ladi.
Air tekshirganida yuk URL 404 qaytardi. Yozish paytida, ombor GitHub'da hali ham faol edi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha mudofaani o'lchaydi.
Hisobotni oling
A cryptomining and backdoor campaign that abuses Hugging Face model repositories came back within days of being taken down.
Its most popular malicious model was downloaded more than 28,000 times.
Separately, researchers flagged a fake Solana starter kit on GitHub, live since late 2025, that is positioned to trick AI coding agents into installing a remote access trojan.
Code runs before the model loads
Researchers at Pluto Security found 31 malicious repositories across seven Hugging Face accounts, published in two waves since September.
The models pose as small Qwen2 test checkpoints. They target GPU hosts running self-hosted inference servers such as Xinference and GPUStack.
With linked models included, the repositories have more than 32,000 downloads. Pluto notes that this counts downloads, not confirmed infections.
Instead of using poisoned weights or pickle exploits, the campaign abuses a Hugging Face option, trust\remote\code, that lets a model ship its own Python code. When a user enables it, that code runs on their machine as soon as the model loads.
The most downloaded model, MENXIANGYU/qwen2-tiny, contained no actual model at all. Its code quietly installs a cryptocurrency miner disguised as a Linux system process, restarts it if killed, and removes competing miners from the machine.
Some versions also open a reverse shell, giving the attacker direct access to the infected server.
Back within days of takedown
Pluto found the campaign through a test account whose leftover backup files pointed to the attacker's main accounts. It reported the first wave to Hugging Face and China's ModelScope, and both removed the accounts.
How Pluto linked the test account to the campaign's main accounts (Pluto Security)
A second wave of 19 repositories appeared under new accounts within days.
Hours after Pluto reported it, the operator published another model with a script that can break out of a container and take over the server underneath.
Pluto says the second-wave repositories were still live eight days after it reported them. Downloads of the flagship model climbed from 7,354 at the time of the report to 28,412 by October 28.
As of writing, Hugging Face has disabled access to that model. A near-identical copy uploaded on October 25 by a newer account, htt0118, is still live, and BleepingComputer confirmed it contains the same miner and reverse shell:
'htt0118/qwen2-tiny' model still live on Hugging Face at the time of writing (BleepingComputer)
Clean scans, real payouts
Hugging Face scans uploads with antivirus and partner tools from Protect AI and JFrog. Pluto says these look for known malware and unsafe model formats, rather than what a model's Python code actually does.
"The second-wave flagship scanned clean while it collected 28,412 downloads,"the researchers said, adding that JFrog reported the payload file was "not a machine-learning model."
According to Pluto, the operator's main wallet has received roughly $5,000 in Pearl (PRL) cryptocurrency. It was still active on mining pools after the repositories behind it were removed.
While the researchers watched, nine machines that appear to belong to a shared research GPU cluster started mining for the operator at once.
They dropped off about six minutes later, which Pluto says fits an admin killing the jobs.
Pluto attributes the campaign to a financially motivated, Chinese-speaking operator. It cites Simplified Chinese code comments, command-and-control servers on Alibaba Cloud, and activity times that fall late at night in China.
Anyone who loaded these models with trust\remote\code enabled should treat the machine as compromised, check it against the indicators in Pluto's report, and rotate any credentials it could reach. Killing the miner alone doesn't remove the backdoors.
Fake Solana kit targets AI coding agents
In a separate report, Air Security describesa GitHub repository, SolanaUpdateTools/solana-starter-kit, that it says ranks as the top result when AI coding agents search for a Solana starter kit.
An agent that picks the repository and follows its README could run the attacker's command without the developer ever seeing it.
The repository was created in November 2025 and has 286 stars. Its README promises a full Solana app template, but none of that code exists, and the README is the only file in the repository:
Fake Solana starter kit still live on GitHub at the time of writing (BleepingComputer)
The README's only "installation" step tells users to paste a PowerShell one-liner into a command prompt. The Windows-only command assembles a URL on developer-update[.]app from fragments, then fetches and runs a script from it in memory.
BleepingComputer obtained the archived payload from the Internet Archive's Wayback Machine and confirmed Air's findings.
The payload installs NetSupport Manager, a legitimate remote-access tool, configured to connect to maxwintodaybtc[.]com and give the attacker hidden control of the machine at every login.
The script then displays a fake error saying "developer functionality is temporarily paused due to load"and to "try again in 72 hours,"which an agent could easily relay as a routine server hiccup.
Air linked the setup to a known NetSupport RAT operator tracked by eSentire, and to an earlier campaign that lured crypto traders with fake TradingView "AI signal"tools.
The payload URL returned a 404 when Air checked. At the time of writing, the repository was still live on GitHub.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report