Pluto Security finds 31 malicious Hugging Face model repos with 29K downloads

The campaign exploited documented Transformers loading behavior, using trust_remote_code=True to run malicious Python code before model weights loaded. The payloads included cryptominers disguised as legitimate processes, reverse shells, and kernel-thread-based miners. First-wave payouts totaled about 2,276 PRL (roughly $5,000), and the campaign targeted Xinference and Tencent Cloud environments. Pluto attributes the operation to a financially motivated, Chinese-speaking group, citing Simplified Chinese comments and Alibaba Cloud infrastructure. The report recommends users check for malicious processes, registry entries, and connections to listed servers, and advises rebuilding affected machines from trusted images.