IncidentsHugging Face mining malware returns days after takedown
A crypto-mining campaign using malicious Hugging Face models came back after being removed, with one model downloaded more than 28,000 times.
29 Oct 2026
Hugging Face crypto-mining malware campaign resurfaces, targets AI coding agents
A crypto-mining malware campaign using malicious Hugging Face models returned days after being taken down, hijacking GPU servers and planting backdoors; one model was downloaded over 28,000 times. A related fake Solana starter kit on GitHub was designed to trick AI coding agents into installing a NetSupport RAT.
Disclosed 29 October 2026 · Record updated 29 October 2026
Impact
GPU servers hijacked for crypto mining and backdoors planted via malicious models; a separate malicious GitHub repo aimed to compromise AI coding agents with a remote access trojan.
Our coverage
IncidentsSources
- bleepingcomputer.comhttps://bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining