VQV Signal
According to BleepingComputer, a crypto-mining campaign abusing Hugging Face models returned days after a takedown, hijacking GPU servers and planting backdoors. One model in the campaign was downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT, a remote access trojan.
According to BleepingComputer, a crypto-mining campaign abusing Hugging Face models returned days after a takedown, hijacking GPU servers and planting backdoors. One model in the campaign was downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT, a remote access trojan.
AI-assisted summary based on the listed source.
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]
Teams that download open models or use AI coding agents to pull in starter code could end up with compromised GPU servers or backdoored machines. Security and infrastructure staff should check how they vet model downloads and dependencies. Watch for further takedowns and whether Hugging Face and GitHub tighten controls on models and repositories.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Hugging Face has a source-backed pricing with coverage spanning pricing.
Hugging Face malware campaign returns to hijack GPUs for crypto mining
Hugging Face malware campaign returns to hijack GPUs for crypto mining
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to BleepingComputer.
No login, cookies, social SDKs, or automatic posting.
