Pluto Security Uncovers Self-Iterating Cryptominer Campaign Hidden in Hugging Face AI Models

Signup Write New Story Pluto Security Uncovers Self-Iterating Cryptominer Campaign Hidden in Hugging Face AI Models by Kevin John by Kevin John | @ kevinsftribune Tech analyst and reporter covering startups, public tech companies, and executives. Associate Editor at The San Francisco Tribune.

Tech analyst and reporter covering startups, public tech companies, and executives. Associate Editor at The San Francisco Tribune.

A financially motivated operator or small group has been using the Hugging Face Hub since September 2026 to distribute cryptocurrency miners and backdoors disguised as small Qwen2 language models, according to a report shared by Pluto Security. The campaign has run through two waves and more than 40 code iterations across 28 repositories. Its second wave remained live as of October 25, five days after Pluto Security reported it. Downloads across the campaign and its linked models had passed 21,000 by that date.

Pluto Security reported the first wave to Hugging Face and ModelScope. Both Hugging Face accounts behind that wave and a ModelScope mirror were taken down. Within days, a second wave appeared under four new accounts, with revised loaders and reverse shells in place of the first wave's hardcoded SSH key. A header comment in the wave-two payload references "report §9.1" and states that "ammunition must be self-hosted."

The campaign spans 28 repositories across six Hugging Face accounts and a ModelScope mirror. Counting seven linked repositories that share technique without proven shared ownership, the total reaches 35. According to Pluto Security's October 25 findings, downloads break down as 18,544 on the 16 live second-wave repositories, 2,342 on the linked models, and 728 recorded on the first wave before removal, for 21,614 in all.

A single repository, MENXIANGYU/qwen2-tiny, accounts for about 97% of second-wave downloads. It stood at 7,354 downloads on October 20, when Pluto Security disclosed it, reached 9,584 within hours, and was listed at 18,012 on October 25.

The payload rides on a documented Hugging Face feature. When a user loads a model with trust_remote_code=True, an auto_map entry in the repository's config.json tells Transformers to download and import a Python file from the repository. That code runs with the caller's privileges during model loading, so no malicious weights are needed. The flagship's model.safetensors is a 42-byte file containing no tensors.

According to Hugging Face's security documentation, every file under 2 GB is checked by its ClamAV malware scanner at each commit. Partner scanners from Protect AI and JFrog also check supported machine-learning model formats.

Those checks did not flag the malicious Python loader files identified in Pluto Security's investigation. In its tests, modeling_evil2.py in qwen2-tiny came back safe from every scanner that ran, with JFrog reporting it was not a machine-learning model. None of the 12 first-wave repositories were flagged.

The Transformers security policy places responsibility on the user, advising developers to "always verify the content of the modeling files when using this argument."

The campaign grew from a 37-line SSH backdoor to a 305-line fileless miner in three weeks, then was rebuilt after the takedown with reverse shells and more varied payloads.

Pluto Security also traced mining proceeds. The first-wave payout wallet was still active on public pool dashboards on October 21, long after its repositories were removed. According to the researchers, it had received about 2,276 PRL, valued at roughly $5,000 at the time, across 716 transactions and sent about 2,241 PRL onward.

Two live workers reported PeakMiner, the same mining client Pluto Security recovered from the second-wave binary. While Pluto Security analyzed the wallet, nine workers named like a shared notebook cluster joined within 90 seconds of each other and stopped submitting shares about six minutes later, consistent with an administrator terminating the jobs.

The miner launches fileless from memory using memfd_create and runs as a process disguised as a kernel worker, [kworker/u20:1]. Earlier builds also throttled the miner to stay under monitoring thresholds. The binary is hosted in the repositories, with mirror fallbacks.

The syscore.bin file is 33.8 MB in wave one and 40.6 MB in wave two, where it is packed with UPX and two packer markers were altered from UPX! to PEK! so that upx -d rejects the file. Pluto Security restored both markers and unpacked it to reveal peakminer.

Persistence goes deep. Early builds planted an ed25519 SSH key in six paths, including the xinference user's home. Payloads also add shell-startup hooks in /root/.bashrc, /root/.profile and ~/.bashrc, a watchdog at /tmp/.cch/svc.py that restarts a missing miner every 120 seconds, and, in wave one, cron persistence.

Three wave-two builds open a reconnecting reverse shell to 212.32.253.3 on port 443 or 9443 before mining. The r1r13 payload performs GPU platform discovery for LLaMA-Factory deployments and collects Tencent Cloud metadata, with exfiltration to 2.28.9.199:7000. The wave-one command-and-control server, 8.137.187.63, sits on Alibaba Cloud.

Pluto Security's assessment points to a financially motivated, Chinese-speaking operator or small group. Wave-one code carries comments in Simplified Chinese such as "daemon disguise name," "blend into Xinference directory" and "kill rival processes."

The command-and-control runs on Alibaba Cloud, the miner binary is mirrored on ModelScope and hf-mirror.com, the targeting assumes Xinference and Tencent Cloud, and activity clusters between 18:38 and 21:19 UTC, which is late night in China Standard Time.

One wave-two line, the soumikmahato "parasit" build, carries Indonesian-language comments and a different build system. Pluto Security says that fits either a second operator in the same niche or one operator running a deliberately different-looking line for redundancy.

Pluto Security advises reviewing the.py files an auto_map points to before setting trust_remote_code, pinning the reviewed revision, and running untrusted code with limited privileges, restricted network access and no production secrets.

Teams that loaded one of the listed models should check hosts for /tmp/.cch/, unexpected svc.py processes, and a process named [kworker/u20:1] carrying mining arguments, and inspect Xinference registrations for encoded qwen2-tiny- or ezv- names.

Cleaning the miner is not enough, because killing it or deleting the model does not remove persistence. Tokens, cloud credentials, passwords, and SSH keys the compromised process could reach should be rotated from a clean machine.

Pluto Security also notes that a static check at upload time for subprocess, socket, ctypes or raw-IP network calls in files referenced by auto_map could have caught these payloads earlier.

This article was published under HackerNoon's Business Blogging program.

Upwind Raises $400M Series C at $3.8B Valuation as Revenue Quadruples in 2026

Hud Launches Agentic Rollouts to Move AI-Written Code From Pull Request to Production