Hugging Face malware campaign returns to hijack GPUs for crypto mining
Overview
A recent malware campaign has resurfaced, exploiting Hugging Face models to hijack GPU servers for cryptocurrency mining. Days after a previous takedown, attackers have planted backdoors in systems, with one model being downloaded more than 28,000 times. This poses a significant risk to organizations using these models, as their computing resources can be misappropriated for illicit mining activities. Additionally, researchers have identified a fake Solana starter kit on GitHub, which is designed to trick AI coding agents into installing a remote access Trojan (RAT) called NetSupport. This highlights the ongoing vulnerability in the AI and crypto spaces, where malicious actors are increasingly targeting users and infrastructure.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Hugging Face models, GPU servers, Solana starter kit
- Action Required: Organizations should monitor their GPU servers for unauthorized access and ensure they are using trusted sources for model downloads.
- Timeline: Ongoing since recent days
Original Article Summary
A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. [...]
Impact
Hugging Face models, GPU servers, Solana starter kit
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since recent days
Remediation
Organizations should monitor their GPU servers for unauthorized access and ensure they are using trusted sources for model downloads. Regular security audits and the implementation of robust access controls are recommended.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Vulnerability, Malware, Trojan.