---
title: "Hugging Face malware campaign returns to hijack GPUs for crypto mining"
type: signal
url: https://frontiernewswire.com/s/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-67a0b650
published: 2026-10-29T22:09:24.000Z
byline: "Source: BleepingComputer"
---

# Hugging Face malware campaign returns to hijack GPUs for crypto mining

Source: BleepingComputer · Published 2026-10-29 · Canonical: https://frontiernewswire.com/s/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining-67a0b650

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. \[...\]

In this story: [AI security](https://frontiernewswire.com/topics/ai-security), [Hugging Face](https://frontiernewswire.com/companies/hugging-face), [GitHub](https://frontiernewswire.com/companies/github)

## Sources

- [Read the original at BleepingComputer](https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining)

## On Bluesky

- [Tomas Ström (@hapsis.bsky.social)](https://bsky.app/profile/hapsis.bsky.social/post/3mz2gbtolcc27) (Oct 29, 2026 · 1 like · 1 repost): Hugging Face malware campaign returns to hijack GPUs for crypto mining www.bleepingcomputer.com/news/securit... \#Cybersecurity \#ThreatIntel \#Vulnerability
- [Keith (@entorisec.bsky.social)](https://bsky.app/profile/entorisec.bsky.social/post/3mz2exctfsc2i) (Oct 29, 2026): Pluto Security found 50 malicious Hugging Face repos posing as Qwen2 test models, per BleepingComputer. They abuse trust\_remote\_code to install a miner and RAT on GPU hosts. bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/

## Related on Frontier

- [Attackers compromised 42 GitHub repositories by using files too large to be searched](https://frontiernewswire.com/s/attackers-compromised-42-github-repositories-by-using-files-too-large-69c91e13)
- [We urgently need to monitor AI agents’ actions in real time](https://frontiernewswire.com/s/we-urgently-need-to-monitor-ai-agents-actions-in-real-time-59cda049)
- [DOJ Inquires About Nvidia’s Hugging Face Deal, Reuters Says](https://frontiernewswire.com/s/doj-inquires-about-nvidias-hugging-face-deal-reuters-says-483bc4aa)
- [GitHub says it's seeing 7.4B commits per month, up from 2.9B in August, and has added 4M CPU cores and 160PB of storage in 2026 so far to support this growth (Frederic Lardinois/The New Stack)](https://frontiernewswire.com/s/github-says-its-seeing-7-4b-commits-per-month-up-from-2-9b-in-august-5b569c58)

---

[More Latest Signal](https://frontiernewswire.com/) · [Signals](https://frontiernewswire.com/verified-reporting)