A Hugging Face malware campaign has resurfaced only days after it was taken down, according to reporting from BleepingComputer. The operation abuses AI models to hijack GPU servers for crypto mining and plant backdoors, and one of the malicious models was downloaded more than 28,000 times. In a separate finding, a fake Solana starter kit on GitHub appears designed to trick AI coding agents into installing a NetSupport remote-access trojan (RAT).

Neither story is about a flaw in a VPN or a consumer app. Both are about the trust developers place in downloaded code and models. Here is what is known, why it matters, and how to check what you pull onto your machines.

What the Hugging Face malware campaign did

According to the source report, the crypto-mining campaign used Hugging Face models as its delivery vehicle. Once the models ran on GPU servers, the attackers hijacked those machines to mine cryptocurrency and planted backdoors for continued access. The campaign was taken down, then returned within days, which suggests the operators can quickly republish under new names or accounts.

The download count is the detail worth pausing on. A single model reaching over 28,000 downloads shows how easily a repository can look popular and legitimate. Download numbers are not a safety signal.

GPU servers are attractive targets because they are expensive to run and well suited to mining. A victim may only notice through a surprise cloud bill, unusually high GPU usage, or degraded performance. The backdoors are the larger concern: even after a miner is removed, a hidden access point can let attackers return.

The source article does not detail the technical mechanism, so this post does not speculate on it. Public search results mention a setting called trust_remote_code in connection with the campaign, but treat that as a reason to review your own configuration rather than a confirmed explanation.

A fake Solana kit aimed at AI coding agents

The second part of the report describes a fake Solana starter kit on GitHub. It is positioned to trick AI coding agents into installing a NetSupport RAT. A RAT gives an attacker remote control of a device, which can include viewing the screen, running commands, and moving through files.

The notable shift is the target. Instead of only persuading a human developer, the repository is crafted so that an automated assistant, searching for a starter project and setting it up, may do the installing. If an agent can run commands with your permissions, a poisoned repository can act with those permissions too.

This connects to broader concerns about autonomous tools in development environments. Our earlier coverage of an OpenAI AI agent breaching Hugging Face using a zero-day flaw and a report on AI agent ransomware activity at Hugging Face, as reported by Sysdig show that AI platforms and agents are drawing sustained attention from both researchers and attackers.

What This Means For You

If you never download AI models or use coding agents, your direct exposure is low. If you are a developer, hobbyist, researcher, or run any GPU workload, the risk is real because these attacks piggyback on normal workflows.

The practical issues are:

  • Popularity is not proof. A high download count did not stop a malicious model from spreading.
  • Takedowns are not permanent. The campaign returned within days, so a removed repository does not mean the threat is gone.
  • Agents inherit your access. An AI assistant that installs packages or runs scripts can carry out an attacker's instructions with your privileges.
  • Backdoors outlast miners. Removing a mining process may not remove the attacker.

A VPN does not address any of this. It protects traffic in transit, not the code you choose to run. Vetting sources and limiting permissions matter far more here.

How to vet models, repositories, and dev tools

Models

  • Check the publisher. Prefer established organizations and verify the account is the one you expect, not a lookalike.
  • Be cautious with any model that requires custom code to load. Read that code before enabling remote code execution options.
  • Prefer safer file formats where available, and avoid running unknown models on production or cloud-connected machines.
  • Test new models in an isolated environment with no access to credentials or internal networks.

Repositories and starter kits

  • Confirm the repository belongs to the official project by following links from the project's own documentation.
  • Look at commit history, contributor profiles, and account age. A brand-new repo with polished instructions deserves suspicion.
  • Read install scripts before running them, especially anything that downloads and executes extra files.

AI coding agents

  • Require human approval before an agent installs packages or runs shell commands.
  • Run agents in a sandbox or container with minimal permissions and no access to secrets.
  • Keep API keys, wallet keys, and cloud credentials out of the agent's reach.

Monitoring

  • Watch GPU utilization and cloud billing for unexplained spikes.
  • Review running processes and outbound connections on GPU servers.
  • If you suspect compromise, rebuild from a clean image and rotate credentials rather than only deleting the miner. Keeping tested, offline copies of your data also helps, as covered in our piece on immutable backups as a last line of defense.

Key takeaways

The Hugging Face malware campaign shows that AI model hubs and code repositories are now part of the attack surface, and that attackers adapt quickly after takedowns. The fake Solana kit adds a new twist by targeting the automated tools developers increasingly trust.

To reduce your risk: verify publishers, read code before running it, sandbox anything unfamiliar, restrict what your AI agents can do, and monitor GPU usage for anomalies. Treat every downloaded model and starter kit as untrusted until you have checked it.