A recent report by **Pluto Security** has unveiled a resilient cryptomining and backdoor operation that exploits legitimate AI model repositories on **Hugging Face**. This campaign, which quickly re-emerged after being reported, poses a significant threat to GPU hosts running self-hosted inference servers. ### Malicious Models Weaponize `trust_remote_code` **Pluto Security** researchers identified 31 malicious repositories spread across seven **Hugging Face** accounts. These models, disguised as small **Qwen2** test checkpoints, specifically target environments using inference servers like **Xinference** and **GPUStack**. Unlike traditional methods such as poisoned weights, this campaign abuses the `trust_remote_code` option within **Hugging Face**. When enabled by a user, this feature allows a model to execute its own Python code immediately upon loading, effectively bypassing typical security checks. The most popular malicious model, `MENXIANGYU/qwen2-tiny`, despite its name, contained no actual AI model. Instead, its embedded code covertly installs a cryptocurrency miner, disguised as a Linux system process, which then actively defends itself against termination and removes competing miners. Some variants also establish a reverse shell, granting attackers direct access to the compromised server. ### Rapid Resurgence After Takedown **Pluto Security** discovered the initial wave of attacks through a test account's backup files, which led them to the operator's primary accounts. Following their report to **Hugging Face** and **ModelScope**, the malicious accounts were promptly removed.  **How Pluto linked the test account to the campaign's main accounts** (Pluto Security) However, a second wave of 19 new repositories appeared under new accounts within days. Hours after this second wave was reported, the operator even published a new model containing a script capable of container escape, allowing it to seize control of the underlying server. Despite being reported, some second-wave repositories remained active for over a week, with downloads of the flagship malicious model surging from 7,354 to 28,412. While **Hugging Face** has since disabled access to the primary offending model, a near-identical copy uploaded by a new account, `htt0118`, was still active at the time of writing, confirmed to contain the same miner and reverse shell.  **‘htt0118/qwen2-tiny’ model still live on Hugging Face at the time of writing** (BleepingComputer) ### Evasion and Financial Gains **Hugging Face** employs antivirus and partner scanning tools from **Protect AI** and **JFrog** for uploads. However, **Pluto Security** notes these tools primarily check for known malware signatures and unsafe model formats, rather than analyzing the actual Python code's behavior. The second-wave flagship model, despite its malicious payload, reportedly scanned clean while accumulating thousands of downloads. The attacker's main cryptocurrency wallet has received approximately $5,000 in **Pearl (PRL)** cryptocurrency, with mining operations continuing even after the associated repositories were removed. **Pluto Security** attributes the campaign to a financially motivated, Chinese-speaking operator, citing Chinese code comments, **Alibaba Cloud** command-and-control servers, and activity patterns consistent with late-night hours in China. Organizations and users who loaded these models with `trust_remote_code` enabled should consider their systems compromised. It is crucial to check against indicators provided in **Pluto Security**'s report and rotate all potentially exposed credentials. Simply terminating the miner will not remove the installed backdoors. ### Fake Solana Kit Targets AI Coding Agents In a separate but related development, **Air Security** reported on a malicious **GitHub** repository, `SolanaUpdateTools/solana-starter-kit`, designed to trick AI coding agents. This repository currently ranks as a top search result for **Solana** starter kits, making it a prime target for automated development tools.  **Fake Solana starter kit still live on GitHub at the time of writing** (BleepingComputer) Created in November 2025, the repository boasts 286 stars but contains no actual **Solana** code. Its `README` file, the only content, instructs users to execute a PowerShell one-liner that fetches and runs a script from `developer-update[.]app` in memory. This command, designed for Windows, goes unnoticed by developers if an AI agent automatically follows the `README`'s instructions. **BleepingComputer** confirmed that the payload installs **NetSupport Manager**, a legitimate remote-access tool, configured to connect to `maxwintodaybtc[.]com`. This grants attackers hidden control over the machine upon every login. After installation, the script displays a fake error message, easily misinterpreted by an AI agent as a routine server issue.  **Fake error message displayed by the PowerShell payload** (BleepingComputer) **Air Security** has linked this setup to a known **NetSupport RAT** operator previously tracked by **eSentire**, and to an earlier campaign targeting crypto traders with fake **TradingView** AI signal tools. Although the payload URL was no longer active, the **GitHub** repository remained live at the time of writing, posing an ongoing risk to developers relying on AI coding assistants.