Hugging Face mining malware returns days after takedown

A crypto-mining malware campaign that abused models hosted on Hugging Face has reappeared days after the original uploads were taken down, according to a report published by BleepingComputer on 29 October 2026. The campaign hijacks GPU servers to mine cryptocurrency and plants backdoors on the machines it infects. BleepingComputer reports that one of the malicious models was downloaded more than 28,000 times.

Hugging Face is the largest public repository for machine learning models. Developers and AI teams pull models from it in much the same way software developers pull packages from a registry, which means a poisoned model can spread quickly and quietly into build pipelines and training environments. GPU servers are an attractive target for mining because they offer exactly the kind of parallel compute that both model inference and cryptocurrency mining require.

The return of the campaign after a takedown is the part that matters most for defenders. Removing individual malicious artefacts does not stop an operator who can simply re-upload. Any organisation that pulled one of the affected models before the takedown would still be running the payload, since deletion from the hub does not reach machines that have already downloaded and executed the file.

BleepingComputer also reports a separate but related piece of activity: a fake Solana starter kit published on GitHub that is positioned to trick AI coding agents into installing a NetSupport remote access trojan. NetSupport is a legitimate remote administration tool that is routinely repurposed by attackers to gain hands-on control of a victim machine. A starter kit is a template repository that developers clone to begin a new project, so it is the kind of artefact a coding agent might fetch and run without close human review.

That detail points at a specific weakness in agentic coding workflows. An AI coding agent asked to scaffold a Solana project may search for a suitable template, clone it and run its install steps. If the agent executes setup scripts with the developer's privileges and without a human reading the code first, the attacker does not need to compromise a human at all. The agent becomes the delivery mechanism.

The practical mitigations are familiar ones. Treat models and repositories pulled from public hubs as untrusted code. Pin and verify what you download rather than trusting a name. Run agent-driven installs in sandboxes that have no access to credentials, production networks or GPU fleets. And monitor GPU utilisation, because sustained unexplained load is one of the clearest signals that a mining payload is present.

BleepingComputer did not report how many organisations were affected beyond the download count, and the status of the campaign at the time of publication was that it had resurfaced rather than been fully removed.