Hugging Face malware campaign returns to hijack GPUs for crypto mining
Summary
A crypto-mining campaign that leverages Hugging Face models has resurfaced after its initial takedown. This campaign continues to hijack GPU servers and install backdoors, with one malicious model achieving over 28,000 downloads. Additionally, a separate incident involves a fake Solana starter kit on GitHub designed to deceive AI coding agents into installing a NetSupport RAT.
IFF Assessment
This article details ongoing malicious campaigns that compromise systems and steal resources for cryptocurrency mining, representing a direct threat to defenders.
Defender Context
Defenders need to be aware of campaigns that exploit legitimate platforms like Hugging Face and development tools like GitHub to distribute malware. This highlights the growing threat of supply chain attacks and the need for robust security monitoring, especially for systems with valuable resources like GPUs.