Hugging Face malware campaign returns to hijack GPUs

# Hugging Face malware campaign returns to hijack GPUs

https://gcdradar.vercel.app/incidents/hugging-face-malware-campaign-returns-to-hijack-gpus · AIR-2026-1655 · closed 2026-11-12

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation): Confirmed real-world malicious campaign abusing hosted models for cryptojacking.
- Fix status: No fix needed
- First reported: 2026-10-29
- AI role: Attack on AI
- Products: Hugging Face

## Summary

A crypto-mining campaign returned to Hugging Face, hijacking GPU servers by distributing backdoored models downloaded over 28,000 times. Attackers also used a fake Solana starter kit on GitHub to target AI coding agents.

## What to do

Review downloaded models from untrusted authors and audit GPU server activity.

## Latest updates

- 2026-10-29: Hugging Face malware campaign returns to hijack GPUs for crypto mining (https://bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining)

## Sources

- 2026-10-29 BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining https://bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.