Pluto Security Details Load/Mine Cryptomining Campaign on Hugging Face

Pluto Security’s research team on October 29, 2026 published its Load/Mine report, disclosing a cryptomining and backdoor campaign distributed through malicious Hugging Face model repositories. The report counts 31 malicious repositories across seven Hugging Face accounts plus a mirror on ModelScope, with 29,818 recorded campaign downloads and 32,376 when 13 linked repositories are included. Pluto states that the figure measures downloads, not confirmed infections or unique victims.

The report, authored by Shaked Chen, Eitan Chassid and Yotam Perkal, says the campaign returned within days of an initial takedown: 19 second-wave repositories recorded more than 29,000 downloads and were still live eight days after Pluto reported them. The first-wave payout wallet received about 2,276 PRL, roughly $5,000, in on-chain mining proceeds, according to the report.

How the Malicious Code Executes

The campaign relies on a documented Transformers loading behavior rather than poisoned weights. Loading a repository with trust_remote_code=True imports the repository’s Python code with the caller’s privileges before any weights load. The repository’s config.json uses auto_map to name the Python module and class to load; Transformers downloads the referenced file into its module cache, and the exec_module() call runs the file’s top-level code before returning the requested model class. The report notes this is documented behavior, not a default, and that the Transformers security policy instructs users to verify the content of modeling files when using the argument. The report also cites CVE-2026-22807, in which vLLM versions from 0.10.1 up to the fix in 0.14.0 loaded auto_map modules without checking the trust_remote_code setting, allowing a malicious repository to run code at server startup.

Discovery and Account Linkage

Pluto built a scanner covering every .py file referenced by auto_map in a config.json, plus Python files sitting beside model weights, flagging patterns such as subprocess, socket, ctypes, memfd_create and base64 decoding. The initial hit was dsxk4mr8tq/qwen2-tiny-gpt2, carrying a 305-line file named modeling_evil.py; the account held six repositories created within 2.5 hours on October 12, 2026.

The break in attribution came from backup files. The qwen2-tiny-lite repository contained modeling_evil.py.bak-src and modeling_evil.py.bak-sync, older versions of the same malware whose download URLs pointed not at the throwaway account but at hhzz667 on Hugging Face and wssb123e on ModelScope. The report says the operator copied production code into a test account, updated the URLs in the main file and forgot the backups. Wave one totaled 12 repositories across three accounts and two platforms, with more than 700 downloads recorded before removal and zero security flags.

Payload Anatomy

Taking MENXIANGYU/qwen2-tiny as a representative build, the report describes a payload that first writes /tmp/.cch/svc.py, a watchdog that restarts a missing miner every 120 seconds, with launch hooks appended to /root/.bashrc, /root/.profile and the user’s .bashrc. Three builds add a reverse shell connecting to 212.32.253.3 on ports 443 or 9443, retrying after every disconnect.

The miner binary, syscore.bin, is launched through memfd_create and fexecve disguised as the kernel worker kworker/u20:1, leaving no executable path on disk for the first launch, with a fallback copy persisting in /tmp/.cch/sync. The 40.6 MB binary is UPX-packed with two UPX! markers changed to PEK! so the standard unpacking tool rejects it; Pluto restored the markers and unpacked a miner called peakminer, launched with pool endpoints and the login krxXJ2PKQW.worker. Progress receipts are written into the local Xinference model registry as qwen2-tiny- followed by base32 status codes, and the payload removes rival miner registrations and kills matching processes.

Two Waves and Adaptation After Takedown

The report traces wave one to the account hhzz667, created April 29, 2026 and dormant for five months. On September 21, 2026 it published qwen2-shell, a 37-line SSH backdoor planting an ed25519 key in authorized_keys with a beacon to an Alibaba Cloud server; its README was copied from the official Qwen2.5-0.5B model card. By September 22 the operator shipped qwen2-final, a 305-line fileless miner with kernel-thread disguise, a competing-miner killer and Xinference status reporting under clean names such as Qwen2Config. Code comments were in Simplified Chinese.

Pluto reported the first wave to Hugging Face and ModelScope, and the accounts were removed. The second wave followed within days: 19 repositories across five accounts, including MENXIANGYU with 13 repositories, plus wjsbg, soumikmahato, r1r13 and htt0118, the last created October 25, 2026. One repository, MENXIANGYU/qa-whl-1021, published 8.5 hours after Pluto’s disclosure email, is a container-to-host escape script that mounts host disks, targets GPUStack’s /var/lib/gpustack directory and gives root login on the host. A later dropper restricts its second stage by source IP, returning a 403 response with the text “static ip.” to other requesters. The flagship repository MENXIANGYU/qwen2-tiny grew from 7,354 downloads on October 20 to 28,412 on October 28, accounting for 97.7% of second-wave downloads.

Mining Proceeds and Observed Victims

The first-wave wallet received about 2,276 PRL across 716 transactions and sent about 2,241 PRL onward, and was still active on public pool dashboards on October 21, after its repositories were removed. On Kryptex the wallet showed two online workers reporting peakminer/2.16.5 with about 1,008 PRL, roughly $2,237, in 30-day rewards at capture time. During analysis, nine workers with notebook-style names joined within 90 seconds of each other and stopped submitting shares about six minutes later, a profile the report describes as consistent with a shared GPU cluster. A separately tracked hl family, using similar import-time execution, showed a MoneroOcean wallet with 13 workers and roughly $26 paid in about a month.

Scanner Coverage Gap

None of the 12 first-wave repositories was flagged, and the second-wave flagship payload modeling_evil2.py returned “safe” from every scanner that ran, with JFrog reporting it was not a machine-learning model, according to Pluto’s checks. Hugging Face’s malware scanning documentation states that every repository file smaller than 2 GB is run through a malware scanner at each commit. Its pickle scanning documentation says the scanner runs ClamAV antivirus scans and pickle import scans, that ClamAV does not cover pickle exploits, and that the scanning is “not 100% foolproof,” with responsibility for checking safety resting on the user. Pluto states that reviewing the .py files an auto_map points to before the flag is set would have caught every payload in the campaign, and that a static upload-time check for subprocess, socket, ctypes or raw-IP calls in auto_map-referenced files would have caught them earlier.

Attribution Assessment and Recommended Steps

Pluto assesses a financially motivated, Chinese-speaking operator or small group, citing Simplified Chinese comments, an Alibaba Cloud command-and-control server, mirroring on ModelScope and hf-mirror.com, targeting that assumes Xinference and Tencent Cloud, and activity clustering between 18:38 and 21:19 UTC. The soumikmahato “parasit” build carries Indonesian-language comments, which the report says fits either a second operator in the same niche or one operator running a deliberately different-looking line.

The report advises anyone who loaded a listed model with custom code enabled to check hosts for /tmp/.cch/, unexpected svc.py processes, a kworker/u20:1 process carrying mining arguments, encoded qwen2-tiny- or ezv- Xinference registrations, and connections to the listed servers and pools. Pluto recommends containing affected machines, preserving evidence, removing all persistence routes, rotating exposed credentials from a clean machine, rebuilding from a trusted image where host integrity cannot be established, requiring authentication on the Xinference API, and pinning reviewed model revisions. Pluto says it expects more campaigns of this kind and is tracking them.