Pluto Security Explains the Hugging Face Cryptominer Campaign in Plain Terms

New York, United States, October 29th, 2026, FinanceWire

If you have ever downloaded an AI model to try it out, this one is worth understanding, because the attack hides in a step many people treat as routine. Pluto Security has published research on a scheme that dresses up cryptocurrency-mining malware as ordinary AI models and posts them on Hugging Face, one of the most widely used places to find and share models. Here is what happened, in everyday terms.

What the Attacker Did

Someone set up accounts on Hugging Face and uploaded fake models that imitate Qwen2, a well-known family of language models. The names were deliberately plain, things like qwen2-tiny and qwen2-mini, the sort of small test model that people load without a second thought. One repository copied the description of the official Qwen2.5-0.5B model word for word. Inside, instead of just a model, there was hidden code, and in the most downloaded one the file that was supposed to hold the model's data was a 42-byte stand-in with nothing in it.

How the Trap Springs

To use some models, you have to switch on a setting that lets the model run its own code on your machine. It is a documented feature meant for models that need custom logic. The catch is that it runs whatever code the uploader put there, before the model even loads. In this campaign, switching it on ran the attacker's program, which fetched a mining tool and put your computer's graphics card to work mining cryptocurrency for the attacker, with no prompt and no error.

Why Nobody Got a Warning

Hugging Face scans uploads, so you might expect this to get caught. It did not. The Hub runs files through antivirus, which matches known malware, and partner scanners check the model weight formats. Nothing analyzes what a plain code file next to the model does. None of the first 12 repositories was flagged, and the most downloaded second-wave model came back clean from every scanner that ran. One tool described a malicious file as not a machine-learning model, which was technically true and exactly the problem.

This is Making Real Money

Mining uses your hardware to earn money for someone else, which shows up as a GPU that is busier than it should be or a cloud bill. Pluto Security traced the attacker's earnings on the public blockchain. The first-wave wallet has received about 2,276 PRL, roughly $5,000, and was still earning after the fake models were removed. At one point the researchers watched nine machines that looked like a shared notebook cluster start mining within 90 seconds of each other, then stop about six minutes later, which fits an administrator shutting the jobs down.

It Keeps Coming Back

The operator adapted to the takedown. After Pluto Security reported the first wave, the original accounts were removed. Within days a new batch appeared under four fresh accounts, with reverse shells in place of the first wave's hardcoded login key. Pluto Security counts more than 40 versions of the code. The most popular fake model had 18,012 downloads by October 25 and was still live five days after being reported.

Why It Is Worse than a Slow Computer

The malware also leaves ways back in login keys, scheduled tasks, tweaks to startup files and, in newer versions, remote-control connections. Pluto Security notes that killing the miner or deleting the model does not remove them, and that the access does not expire when the miner stops. One payload in the second wave also collects cloud metadata and GPU details. Pluto Security says machines like these tend to hold credentials, data and network access worth far more than the compute.

Who Did It, and Why

Pluto Security's assessment is a financially motivated, Chinese-speaking operator or small group, based on comments written in Simplified Chinese inside the code, the Alibaba Cloud hosting, the mirrors the attacker chose and the systems it targeted. The malware mines into real cryptocurrency wallets with real payouts, and it removes competing miners on the same machine, so its own miner gets the compute.

What You Can Do

Do not switch on the setting that lets a model run its own code unless you have read that code. Pluto Security also advises pinning the version you reviewed and running untrusted code with limited privileges, restricted network access and no production secrets. If you think you were hit, do not just delete the miner. Remove the hidden access it left behind and replace your passwords, keys and cloud credentials from a clean machine, because cleaning up the obvious part is not the same as being safe.

Contact