Hugging Face malware campaign returns to hijack GPUs for crypto mining

A crypto-mining campaign targeting Hugging Face models has returned shortly after being taken down, demonstrating persistence and resilience. The attackers are hijacking GPU servers by embedding malicious code within Hugging Face model files. One malicious model was downloaded over 28,000 times before detection, indicating significant reach. The campaign also includes planting backdoors on compromised systems for persistent access. In a related but separate incident, a fake Solana starter kit was discovered on GitHub designed to trick AI coding agents into installing NetSupport RAT. The dual-pronged attack highlights the growing abuse of AI/ML platforms and developer tools as attack vectors. The return of the campaign after takedown underscores the challenges of content moderation on large model-sharing platforms. GPU hijacking for crypto mining represents a significant financial threat to cloud and AI infrastructure operators.