Hugging Face malware campaign returns to hijack GPUs for crypto mining
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT.
Excerpt from the primary source: BleepingComputer
Who is affected
Developers · Security professionals
Affected technology: GitHub
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
Mythos 5 Ignored Real-World Harm in July Attack
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.