<a target="_blank" href="This is a classic supply chain attack targeting the ML/AI pipeline, and it’s persistent. The threat actors are abusing trust in Hugging Face as a legitimate model repository.Technical Breakdown:* Attack Vector: Malicious models uploaded to Hugging Face. The campaign was taken down and then re-uploaded, indicating an active, determined adversary.* Payload: Crypto-mining malware targeting GPU resources (high-value for Monero or similar coins). The secondary payload is a backdoor for persistent access.* Scale: One model hit 28,000 downloads before detection. That’s a massive blast radius for GPU hijacking.* Secondary Campaign: A fake Solana "starter kit" on GitHub targeting AI coding agents (Cline, etc.) to deploy NetSupport RAT. This is a clever evolution—poisoning the tools that build with AI.* TTPs (MITRE): T1195.001 (Supply Chain Compromise - Code Repositories), T1496 (Resource Hijacking), T1059 (Command and Scripting Interpreter).Defense:* For Hugging Face: Implement strict model scanning (e.g., picklescan, safety scanner) before loading any model into a production or research environment. Never run untrusted models with trust_remote_code=True.* For GitHub: Treat any "starter kit" or "boilerplate" repo with extreme suspicion, especially if it claims to automate dependency installation. Pin your dependencies and audit package.json/requirements.txt manually.* Network: Monitor for outbound connections to known mining pools or unusual RAT C2 patterns (NetSupport RAT uses specific TCP ports and registry keys).Source: https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/" title="Hugging Face malware campaign returns to hijack GPUs for crypto mining">full image</a>
<strong> - Repost: Hugging Face malware campaign returns to hijack GPUs for crypto mining</strong> (<i>from Reddit.com, Hugging Face malware campaign returns to hijack GPUs for crypto mining</i>)
<br><blockquote> This is a classic supply chain attack targeting the ML/AI pipeline, and it’s persistent. The threat actors are abusing trust in Hugging Face as a legitimate model repository.Technical Breakdown:* Attack Vector: Malicious models uploaded to Hugging Face. The campaign was taken down and then re-uploaded, indicating an active, determined adversary.* Payload: Crypto-mining malware targeting GPU resources (high-value for Monero or similar coins). The secondary payload is a backdoor for persistent access.* Scale: One model hit 28,000 downloads before detection. That’s a massive blast radius for GPU hijacking.* Secondary Campaign: A fake Solana "starter kit" on GitHub targeting AI coding agents (Cline, etc.) to deploy NetSupport RAT. This is a clever evolution—poisoning the tools that build with AI.* TTPs (MITRE): T1195.001 (Supply Chain Compromise - Code Repositories), T1496 (Resource Hijacking), T1059 (Command and Scripting Interpreter).Defense:* For Hugging Face: Implement strict model scanning (e.g., picklescan, safety scanner) before loading any model into a production or research environment. Never run untrusted models with trust_remote_code=True.* For GitHub: Treat any "starter kit" or "boilerplate" repo with extreme suspicion, especially if it claims to automate dependency installation. Pin your dependencies and audit package.json/requirements.txt manually.* Network: Monitor for outbound connections to known mining pools or unusual RAT C2 patterns (NetSupport RAT uses specific TCP ports and registry keys).Source: https://ift.tt/ZRs9AFg </blockquote>
<hr><h3>
<hr><strong>Mining:</strong> <br>
<a title="Cryptotab browser" target="_blank" href="https://cryptotabbrowser.com/12/4000343"><u>Bitcoin</u>, Cryptotab browser</a>
- <a title="Pi Network, CLOUD PHONEMINING" target="_blank" href="https://minepi.com/cusidore"><u>Pi Network</u> cloud PHONE MINING</a>
<br><a title="Fone, CLOUD PHONE MINING" target="_blank" href="https://play.google.com/store/apps/details?id=com.cloud.earning"><u>Fone</u>, cloud PHONE MINING</a> cod. dhvd1dkx
- <a title="Mintme, PC PHONE MINING" target="_blank" href="https://www.coinimp.com/invite/86d61388-18f9-4f8b-8561-8962c67e7166">Mintme, PC PHONE MINING</a>
<hr><strong>Exchanges:</strong> <br>
<a title="Coinbase.com" target="_blank" href="http://coinbase.com/join/occhip_8?src=android-link">Coinbase.com</a>
- <a title="Stex.com" target="_blank" href="https://stex.com/?ref=27877494">Stex.com</a>
- <a title="Probit.com" target="_blank" href="https://www.probit.com/r/46858290">Probit.com</a>
<hr><strong>Donations:</strong> <br>
<a title="Done crypto" target="_blank" href="https://commerce.coinbase.com/checkout/140e9bb6-c4ef-4156-92cf-9c87a88fd259">Done crypto</a>
</h3><br><br>
Social Media Icons