Hugging Face GPU Hijack: How a Malicious AI Model Campaign Stole Cloud Compute at Scale
Executive Summary
In late October 2026, researchers at Pluto Security uncovered a recurring supply-chain campaign on Hugging Face in which a financially motivated, Chinese-speaking threat actor published 31 malicious AI model repositories across seven accounts in two coordinated waves since September 2026. The models, disguised as Qwen2 test checkpoints, exploited Hugging Face's trust_remote_code feature to execute malicious Python code at model-load time on GPU inference servers. The most downloaded model, MENXIANGYU/qwen2-tiny, accumulated 28,412 downloads, silently installed a cryptocurrency miner, established persistence, and opened reverse shells granting direct server access. The attacker's wallet collected roughly $5,000 in Pearl (PRL) cryptocurrency, and a second wave of repositories reappeared within days of the initial takedown—one introducing a container-escape script. Traditional AV and partner scanning tools returned clean results throughout the campaign.
This incident signals a maturing threat pattern in which adversaries weaponize trusted AI model repositories as a software supply-chain vector, bypassing conventional security controls by abusing legitimate platform features rather than known malware signatures. As enterprises accelerate AI workload adoption on GPU-intensive cloud infrastructure, the attack surface for model-based supply-chain compromise is expanding rapidly, demanding new runtime enforcement and egress control strategies.
Why This Matters Now
AI model repositories are now a primary software supply-chain attack surface. With enterprise GPU adoption surging and tools like trust_remote_code widely enabled, attackers can silently compromise high-value cloud compute at scale. The campaign's ability to evade AV and platform scanning—while accumulating tens of thousands of downloads—demonstrates that perimeter and signature-based defenses alone are insufficient for AI-era infrastructure.
Attack Path Analysis
A financially motivated, Chinese-speaking threat actor uploaded malicious Hugging Face model repositories disguised as Qwen2 test checkpoints, abusing the trust_remote_code feature to execute attacker-controlled Python code at model load time on GPU inference servers. The embedded payload installed a cryptocurrency miner, established reverse shell backdoors for persistent C2, attempted container breakout for host-level access, and exfiltrated compute resources to attacker-controlled mining pools on Alibaba Cloud infrastructure, ultimately netting approximately $5,000 in Pearl cryptocurrency while evading antivirus scanning throughout the campaign.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker published malicious model repositories on Hugging Face under seven accounts, disguising payloads as Qwen2 test checkpoints. By abusing the trust_remote_code=True option, arbitrary Python code embedded in the model repository executed automatically on the victim GPU host the moment the model was loaded by an inference server such as Xinference or GPUStack. No CVE exploitation was required; the attack relied entirely on a legitimate platform feature and social engineering through download count credibility. The CNSF Cloud Native Security Fabric capability, with inline enforcement and AI-based traffic inspection, could have flagged anomalous model-load-time outbound network calls as initial indicators of supply chain compromise. A Cloud Firewall (ACF) with AI discovery of traffic patterns could have detected unexpected outbound connections initiated at model load time.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Command and Scripting Interpreter: Python
Resource Hijacking
Command and Scripting Interpreter: PowerShell
Remote Access Software
Create or Modify System Process
Masquerading: Match Legitimate Name or Location
Escape to Host
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Software, Firmware, and Information Integrity
Control ID: SI-7
CISA Zero Trust Maturity Model 2.0 – Workload Integrity and Least-Privilege Execution
Control ID: Application Pillar - Application Security
NIS2 Directive – Supply Chain Security and Third-Party Risk Management
Control ID: Article 21 - Security of Supply Chain
PCI DSS 4.0 – Protection of Software and System Components from Malicious Software
Control ID: Requirement 6.3.3
DORA (EU) 2022/2554 – Third-Party ICT Dependency Oversight and Monitoring
Control ID: Article 28 - ICT Third-Party Risk Management
ISO/IEC 27001:2022 – Pre-Deployment Security Validation of Third-Party Code
Control ID: A.8.29 - Security Testing in Development and Acceptance
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Malicious Hugging Face AI models with trust_remote_code deploy cryptominers and reverse shells on GPU inference servers, bypassing AV scans and requiring Zero Trust Segmentation and Egress Security controls per NIST.800-53.SC-7.
Computer Software/Engineering
AI coding agents tricked by fake Solana GitHub repositories into executing NetSupport RAT payloads expose software development pipelines to supply-chain compromise, demanding Cloud Native Security Fabric and Egress Policy Enforcement per ZTMM.CrossCutting.Automation.
Research Industry
Shared GPU research clusters confirmed hijacked for cryptomining via malicious Qwen2 model checkpoints, with 28,412 downloads threatening academic compute infrastructure and requiring Multicloud Visibility and East-West Traffic Security per NIST.CSF.DE.CM-1.
Financial Services
Operator wallet receiving $5,000 PRL cryptocurrency and fake TradingView AI signal lures targeting crypto traders signal direct financial sector exposure, necessitating Egress Security and Inline IPS controls mapped to NIST.800-53.SC-18 and PCI.4.0.3.5.1.
Sources
- Hugging Face malware campaign returns to hijack GPUs for crypto mininghttps://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/Verified
- Hugging Face Malware Campaign: Load & Mine (Pluto Security Research Blog)https://pluto.security/blog/hugging-face-malware-campaign-load-mine/Verified
- SolanaCry: Fake Solana Starter Kit Targets AI Coding Agents (Air Security)https://www.air.security/blog-posts/solanacryVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- PoeLLM malware infects exposed AI servers in cryptomining attackshttps://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/Verified
- LiteLLM release pipeline hacked to distribute info-stealer malwarehttps://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/Verified
- NetSupport RAT Campaigns Tracked by eSentirehttps://www.esentire.com/blog/netsupport-ratVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker relied on unrestricted outbound connectivity, lateral movement across a shared GPU cluster, and uncontrolled egress to mining pool infrastructure — all paths that Zero Trust segmentation and inline egress enforcement are designed to constrain. By limiting workload reachability and enforcing identity-aware boundaries, CNSF would likely have reduced the attacker's ability to spread across nodes, establish persistent C2, and exfiltrate compute resources to external destinations.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Anomalous outbound network calls originating at model load time — an unexpected behavior for inference workloads — could have been flagged through inline traffic inspection, likely surfacing early indicators of supply chain compromise before the payload fully established itself.
Control: Zero Trust Segmentation
Mitigation: Identity-aware workload segmentation with namespace-level boundary enforcement would likely constrain the inference container's ability to reach host OS resources, reducing the scope of privilege escalation even if the malicious code executed successfully within the container.
Control: East-West Traffic Security
Mitigation: East-west traffic monitoring and inter-workload segmentation would likely have detected anomalous node-to-node communication patterns consistent with lateral propagation, potentially reducing the attacker's ability to move freely across co-located GPU nodes within the shared cluster environment.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across cloud environments would likely have surfaced repeated outbound connections to non-approved Alibaba Cloud destinations as anomalous automation behavior, reducing the attacker's ability to maintain persistent C2 channels without detection.
Control: Egress Security & Policy Enforcement
Mitigation: Egress filtering with FQDN-based allowlisting and inline IPS signature detection would likely have blocked outbound mining pool protocol traffic to unauthorized external destinations, reducing the attacker's ability to sustain cryptocurrency exfiltration from compromised GPU hosts.
Had earlier stage controls constrained lateral movement and C2 channel establishment, the blast radius of this incident would likely have been limited to fewer nodes, reducing both the scale of GPU resource theft and the number of hosts retaining persistent backdoor access after initial detection.
Impact at a Glance
Affected Business Functions
- AI/ML Model Development and Inference Infrastructure
- GPU Compute Resource Management
- Developer Toolchain and CI/CD Pipeline Integrity
- Credential and Secret Management for Cloud and Research Environments
Estimated downtime: 8 days
Estimated loss: $5,000
Affected organizations running self-hosted GPU inference servers (Xinference, GPUStack) using malicious Qwen2 model checkpoints with trust_remote_code enabled face exposure of: (1) server-level credentials and API keys accessible by the deployed reverse shell backdoor; (2) any secrets or tokens present in environment variables on compromised GPU hosts; (3) potential lateral movement risk within shared GPU research clusters, as evidenced by nine machines on a shared cluster mining simultaneously. Additionally, the fake Solana starter kit installs NetSupport Manager RAT on developer workstations, exposing source code, wallet private keys, developer credentials, and any secrets stored in the development environment. Confirmed attacker wallet received approximately $5,000 USD in Pearl (PRL) cryptocurrency from hijacked GPU resources. Container escape capability in second-wave payloads further risks host-level data exposure beyond containerized workloads.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce egress filtering and FQDN-based policy via Egress Security and Policy Enforcement controls to block outbound connections from GPU inference workloads to unapproved mining pool domains, Alibaba Cloud C2 endpoints, and dynamic payload-staging URLs at the network layer before cryptocurrency mining traffic can be established.
- • Deploy Zero Trust Segmentation with namespace enforcement and least-privilege identity-based policies around GPU inference workloads to prevent container breakout escalation to host-level access and restrict lateral movement across shared GPU cluster nodes through microsegmentation of workload-to-workload communication.
- • Activate Multicloud Visibility and Control with centralized traffic observability to baseline normal inference server outbound connection patterns and alert on anomalous model-load-time network activity, reverse shell beaconing, and simultaneous multi-node outbound connections indicative of cluster-wide compromise.
- • Implement Inline IPS (Suricata) with signatures targeting stratum mining protocol traffic, known cryptominer communication patterns, and reverse shell payload signatures to provide automated inline blocking of C2 and resource exfiltration channels before mining output reaches attacker-controlled wallets.
- • Leverage the Cloud Native Security Fabric (CNSF) with AI-based discovery of traffic to enforce supply chain integrity controls, detect shadow AI model execution anomalies at load time, and apply real-time inline enforcement that isolates compromised inference workloads automatically upon detection of code execution patterns inconsistent with approved model loading behaviors.
